.jpg)
Australian authorities charged two Western Australian men on Aug. 26 following a joint investigation by the FBI, Australian Federal Police and Western Australia Police Force into the alleged TeamPCP cybercrime syndicate.
Fourteen Charges Filed in Perth Court
The Australian Federal Police filed a combined 14 charges against 21-year-old Ruben Ian Thomson and 23-year-old Louis Michael Gaebler. Both appeared before Perth Magistrates Court on Aug. 27. The operation involved the AFP, the FBI and the Western Australia Police Force. Authorities executed warrants at properties in Cottesloe, Hamilton Hill and Mandurah. Police allege the group compromised more than 1,000 organizations, obtained over 500,000 credentials and removed at least 300 gigabytes of data from downstream software customers. The defendants have not been convicted, and the charges remain allegations that must be proven in court.
TeamPCP Targeted Trusted Software Components
The joint investigation began in April after several cybersecurity companies supplied intelligence about malicious software distributed through an open-source repository. Investigators allege TeamPCP inserted malicious code into legitimate software components used by other developers. Once incorporated into downstream systems, the modified code allegedly gave the group unauthorized access to organizations across government, academia and the private sector. Software supply-chain attacks can spread beyond the organization hosting the original compromised code. A trusted component may be reused by hundreds of developers, allowing one modification to reach many unrelated systems. Australian authorities estimated that responding organizations face remediation costs totaling hundreds of millions of dollars, though that figure reflects an official estimate rather than a confirmed financial loss.
Cryptocurrency Payments Remain Under Investigation
Police allege the two men were principal participants in the operation and received cryptocurrency for their roles. Authorities said the value of those payments remains under investigation. The official release did not identify the cryptocurrencies involved. It also did not disclose wallet addresses, transaction hashes, mixers, exchanges or a confirmed laundering total. Reports claiming that investigators seized large cryptocurrency balances or expensive property go beyond the details contained in the AFP announcement. Authorities said electronic devices and other items were seized, but they did not assign a digital-asset value to those items. Thomson faces one Australian charge of dealing with money or property worth at least 100,000 Australian dollars that authorities allege represented criminal proceeds, carrying a maximum prison sentence of 20 years.
Separate U.S. Federal Indictment
The U.S. Department of Justice separately unsealed a federal indictment against Thomson. Prosecutors charged him with conspiracy to violate the Computer Fraud and Abuse Act and obtaining information from a protected computer. The American indictment concerns alleged TeamPCP attacks during spring 2026. Prosecutors claim malicious code scanned downstream systems, extracted sensitive information and maintained persistent access. The Justice Department also alleges TeamPCP used stolen information to make ransom or extortion demands, offering not to publish victims' data in exchange for payment. Each U.S. offence carries a maximum five-year prison term and a fine of up to $250,000, or twice the alleged gross gain or victim loss.
Forensic Examinations Could Produce Further Charges
The AFP said investigators are examining a large volume of seized data and electronic devices. That work may help authorities identify additional participants, victims and financial transfers. Police have not ruled out further arrests or charges. They have also not announced whether the United States will seek Thomson's extradition or wait for the Australian proceedings to advance. The investigation's next phase will involve digital forensics and the examination of cryptocurrency payment records. Prosecutors must separately prove each defendant's identity, role, intent and connection to the alleged activity. The case produced no verified cryptocurrency market reaction, as it concerns the alleged use of digital assets for payments rather than a vulnerability in a blockchain or cryptocurrency protocol.
