There is a special elegance in a hacking gang discovering that one of the people in the room may not be a fellow criminal entrepreneur, but a Google threat analyst wearing the digital equivalent of a false mustache.
According to Ars Technica, reporting from WIRED and details presented at SentinelOne’s LABScon, Google’s threat intelligence operation had an undercover persona inside TeamPCP, a notorious supply-chain hacking group, during a major stretch of its campaign. This is the cybersecurity version of finding out the champagne waiter has been taking notes for the regulator all evening.
🤚 The Open-Palm Infiltration
Google Threat Intelligence Group researcher Austin Larsen said one of Google’s personas had spent months building trust with an actor who was later invited into TeamPCP. As a result, the persona was added to the group’s inner circle. Larsen told WIRED that, essentially from “almost day one,” Mandiant was watching behind the scenes.
TeamPCP is accused of carrying out a chaotic supply-chain hacking spree that touched parts of the software and AI ecosystem. Ars reports that the group compromised or targeted names including the open-source security scanner Trivy, the AI API tool LiteLLM, infrastructure connected to Checkmarx, the web application library TanStack, and the enterprise AI platform Mistral AI. The campaign then allegedly helped the attackers reach additional victims, including GitHub and Mercor.
Australian authorities arrested Ruben Ian Thomson and Louis Michael Gaebler, both reportedly in their early twenties, late last month in a joint investigation involving assistance from the FBI. Australian police described them as principal participants in TeamPCP, according to the reporting.
This is already a premium farce: a supply-chain gang allegedly moving through developer infrastructure with the confidence of a consultant entering a client kitchen, while Google’s intelligence team quietly sits in the group chat like a polite houseplant with subpoenas.
👐 The Two-Handed Supply-Chain Masquerade
The most important detail is not the spycraft glamour, though naturally everyone enjoys a trench coat when it has two-factor authentication. The important detail is that supply-chain attacks have become a prestige criminal product because modern software is built out of dependencies, integrations, tokens, packages, runners, repositories, and trust relationships stacked like a dangerously fashionable wedding cake.
Compromise one tool and you may gain paths into its users. Compromise one credential and you may gain paths into the systems that trusted it. Compromise a maintainer workflow and you may not need to “break in” at all; the victim’s automation may usher you inside with a badge, a lanyard, and artisanal coffee.
That is why TeamPCP’s alleged campaign matters beyond the names involved. It reflects a broader truth: attackers increasingly hunt the connective tissue of technology rather than the front door. The front door has a camera. The supply chain has a thousand side entrances labeled “temporary,” “legacy,” “CI,” “bot token,” and “please do not touch, Dave set this up in 2019.”
Google’s infiltration reportedly allowed defenders to observe the hacking spree from the inside, warn targets, and help disrupt attempts to exploit victims. That is valuable because telemetry after the breach is useful, but visibility before the next move is couture-grade intelligence. It gives defenders a chance to act while the attacker is still deciding which priceless vase to knock over.
🌿 The Gentle Awakening
There is also a cultural insult here, and it is deserved. The technology industry spent years treating “move fast” as a religious instruction, then seemed surprised when adversaries also moved fast, but with fewer brand guidelines.
Open source maintainers became unpaid infrastructure clergy. CI/CD pipelines became production-grade arteries. Developer tokens became skeleton keys. AI startups and security tools bolted services together at speed because the market rewards velocity, not inventory hygiene. Then the criminals arrived and discovered that many organizations had outsourced their risk map to vibes.
In that context, undercover threat intelligence is useful but not sufficient. You cannot infiltrate every criminal group chat, just as you cannot solve fire safety by hiring one excellent firefighter to live inside the arson club. Organizations still need the boring luxuries: least privilege, signed releases, dependency pinning, rapid credential rotation, artifact provenance, segmented build systems, monitored secrets, and incident drills that do not begin with someone asking where the runbook lives.
These measures lack the glamour of an undercover persona. They also prevent the moment when your enterprise AI platform becomes a canapé tray for attackers.
👑 The Gold-Leaf Reckoning
The TeamPCP story is a reminder that cyber defense increasingly looks like counterintelligence, not just patch management. The battlefield is not only servers and endpoints; it is Discord rooms, package registries, GitHub workflows, contractor systems, cloud tokens, and the strange little trust bridges that keep modern software moving.
Google’s apparent success in getting eyes inside the operation is impressive. It is also a warning. If a major defender had to sit inside the criminal salon to watch the knives being sharpened, perhaps the industry’s supply-chain furniture is still too easy to rearrange.
The practical lesson is simple enough to be unfashionable: know what you run, know who can change it, know which machines can publish it, know which secrets can deploy it, and assume that the next attacker will not kick the door. They will arrive as an update.
In cybersecurity, trust is no longer a warm feeling. It is an asset class. Audit it accordingly.
“Your dependency graph is not a family tree; it is a guest list for a robbery.” — The Slap of Wisdom Department of Velvet-Rope Threat Intelligence, observing the group chat from a tasteful distance
Sources: Ars Technica; WIRED reporting cited by Ars; Google Threat Intelligence Group remarks at LABScon.