Google Analyst Goes Undercover Inside Notorious Supply‑Chain Hacking Crew

Google’s Threat Intelligence Group disclosed that one of its researchers operated undercover inside the notorious hacking collective known as TeamPCP. By gaining trust with a member who was later invited to join the group, the analyst was able to observe the gang’s activities from the earliest stages of their supply‑chain assault.

The undercover presence allowed Google to track the contamination of open‑source projects such as Trivy, LiteLLM, Checkmarx infrastructure, TanStack libraries, and enterprise AI platforms. This real‑time visibility helped the company warn potential victims and share actionable indicators with law‑enforcement partners.

Through the information gathered, Australian authorities, assisted by the FBI, arrested two alleged leaders of TeamPCP. Google also received valuable intel from the rival group ShinyHunters, which had turned against the supply‑chain attackers after a partnership soured.

Why it matters for GPU / AI infrastructure

Supply‑chain compromises that target AI‑related tooling can poison model distribution pipelines, corrupt GPU firmware updates, or steal credentials used to manage large‑scale compute clusters. Insight into how threat actors infiltrate these chains enables GPU cloud providers to harden their own build systems, verify artifact integrity, and protect customers who rely on trusted AI software stacks.