Google Analyst Infiltrated Hacker Gang From the Inside

While a notorious hacker gang was executing one of the biggest digital attacks in history, a Google analyst was quietly watching from the inside.

TeamPCP made headlines this year for a hacking campaign unlike anything security experts had seen before. The group infected hundreds of software programs with malware, stole developer accounts, and even created a worm named after Dune's sandworms to automate their attacks. Over 1,000 companies got caught in the crossfire, including OpenAI and the European Commission.

But Google had a secret weapon. In March, just as TeamPCP's chaos was beginning, one of the company's undercover analysts joined the hackers' private chat group called CanisterWorm. Only about 12 people had access to this inner circle.

"Essentially, almost day one, Mandiant was watching everything behind the scenes," said Austin Larsen, a Google Threat Intelligence Group researcher who presented the findings at a security conference. The undercover analyst, whose name remains confidential, spent months building trust with the hackers before gaining access.

Inside the group's servers, Google discovered a massive treasure trove of stolen passwords and access codes. TeamPCP had grabbed credentials from countless victims and was planning to hold companies ransom with them.

Google sprang into action. Instead of contacting each victim individually, which would have taken too long, the team reached out to major providers like Amazon Web Services and Microsoft to revoke the stolen credentials. They sent hundreds of notification emails to shut down the hackers' plans before more damage could happen.

The infiltration also helped law enforcement. Google tracked operational security mistakes made by the group's members and passed identifying details to authorities. Last month, Australian police arrested two men in their early 20s, Ruben Ian Thomson and Louis Michael Gaebler, charging them as principal participants in TeamPCP.

The Ripple Effect

This operation shows how tech companies can actively defend the internet ecosystem instead of just reacting to attacks. By getting inside the threat early, Google prevented potentially thousands of additional breaches and protected companies from extortion attempts.

The collaboration between private security teams and law enforcement created a blueprint for stopping future supply chain attacks. When one part of the digital world gets compromised, the damage can cascade endlessly, but early intervention can stop the dominos from falling.

TeamPCP's own chat logs revealed their awareness of what they'd done. "You guys should understand that we pulled off the biggest supplychain maybe ever recorded in modern history," one member wrote. They were right about the scale, but they didn't know someone was reading every word.

The arrests mark a major victory in protecting the open source software that powers much of the internet.