Google says Mandiant undercover analyst infiltrated TeamPCP supply‑chain hacking group
Google’s Threat Intelligence Group says an undercover Mandiant analyst infiltrated the TeamPCP hacking group, allowing Google to monitor its supply‑chain campaign from the inside, warn potential victims, and share identifying details with law enforcement; two Australians have been arrested and charged as alleged principal participants. TeamPCP is accused of repeatedly tainting open‑source projects (reported targets include Trivy, LiteLLM, TanStack, Checkmarx integrations and Mistral AI), deploying a 'Mini Shai‑Hulud' self‑spreading worm, and breaching organizations such as GitHub, Mercor, OpenAI and the European Commission.