Updated ,first published
A young man from the wealthy western Perth suburb of Cottesloe is accused of being the leader of an international syndicate of hackers that have targeted businesses across the globe.
Ruben Thomson was arrested and charged on Wednesday over his alleged role with the hacking group TeamPCP, a criminal syndicate allegedly responsible for cyberattacks on more than 1000 businesses worldwide.
He was arrested alongside alleged associate, Mandurah man Louis Gaebler, in a joint operation involving WA Police, the Australian Federal Police and the US Federal Bureau of Investigation, whose agents flew into Perth earlier this week.
Gaebler and Thomson, aged 23 and 21, respectively, were arrested after a four-month investigation by the agencies, following raids on homes in the Perth suburbs of Cottesloe, Hamilton Hill and the southern coastal town of Mandurah throughout the day.
Police allege the two men were “principal participants” in the activities – with Thomson the alleged “leader” – and received payments in cryptocurrency to help cover their tracks.
The investigation was sparked in April, after a number of cybersecurity companies tipped off the AFP and FBI about a potential malicious actor they had encountered calling themselves TeamPCP.
The cybersecurity companies said the syndicate would allegedly insert malicious code into software available on an open-source repository – a space where code is stored and developed online – which was then unwittingly used by developers.
The method, also known as a Trojan Horse, meant the code found its way into software updates, and would then infect technology at various organisations, including government systems, academia and private businesses as a way to steal data.
Speaking to media on Thursday afternoon, FBI Assistant Law Enforcement Attaché Dave Andish alleged the two Perth men were “principal partners” in the group, which had allegedly participated in data intrusion, identity crime, and cryptocurrency-based money laundering.
“The FBI and the Australian Federal Police, with the full support of Western Australian state police, carried out parallel investigations, resulting in the arrest of Ruben Thomson, the alleged leader of the cybercriminal group known as TeamPCP,” Andish said.
He said the searches on Thomson and Gaebler’s homes followed a “large-scale software supply chain attack” allegedly launched by TeamPCP in March, with one search uncovering more than 1000 terabytes of data.
Both Thomson and Gaebler appeared in Perth Magistrates Court on Thursday. Gaebler made no application for bail, while Thomson’s lawyer Nick Scerri attempted to launch an application for his release before the magistrate shut it down.
She told Scerri she would not consider bail while police remained at his parents’ Cottesloe address continuing searches and said his high level of computer expertise made him too much of a risk.
“He could interfere with the investigation or alter the course of the investigation,” she said.
During the hearing the court heard allegations that Thomson, who was born in South Africa, and his accused were “key players” in the cyber crime group that used online aliases and pseudonyms to hack data around the world.
“Industry analysts predict the global remediation costs to be in the hundreds of millions,” the prosecutor said.
She added that the AFP were looking at the impact of the alleged offending and said there may be more charges to come.
It was previously publicly reported the March hack had significantly impacted an open-source AI gateway called LiteLLM, which allowed app makers to incorporate artificial intelligence models into their work.
Forbes claimed it spoke to a representative of TeamPCP following the attack, who said the group “was a loose-knit group of teenagers and young adults”.
It is not known how much money either of the men are alleged to have made from the scheme, but Thomson has been charged of dealing with proceeds of crime in with money worth more than $100,000.
Thomson and Gaebler are believed to be the first two arrests made in connection to the investigation, although AFP Commander Graeme Marshall said there could be more to come.
Police alleged the hacking resulted in a theft of more than 500,000 credentials and was believed to have caused hundreds of millions of dollars in damage.
In court Thomson’s bail application was withdrawn until the police investigation has concluded and his lawyer indicated he would re-apply together with Gaegler at a later date.
From our partners
Read the full article here
