Google Infiltrates PCP to Halt Supply‑Chain Attacks

Background of Team PCP

Team PCP emerged on underground forums in late 2025, quickly gaining notoriety for a “cascading” supply‑chain strategy that differed from traditional ransomware or espionage groups. Rather than targeting a single high‑value victim, the gang systematically compromised open‑source projects, harvested developer credentials, and injected malicious payloads into downstream tools. By the spring of 2026 the group had already tainted dozens of libraries, creating a self‑reinforcing loop that amplified its reach with each new compromise.

Key characteristics that set Team PCP apart:

• Open‑source focus – The attackers chose widely adopted projects (e.g., Trivy, Lite LLM) to maximize blast radius.
• Credential theft – After compromising a repository, they harvested SSH keys, GitHub tokens, and cloud API secrets.
• Self‑spreading worm – The “Mini Shai‑Hulud” worm automatically propagated across developer machines, reducing manual effort.

The group’s operational security (OpSec) was surprisingly lax for a criminal organization of its scale. Mistakes such as reusing personal email aliases and failing to encrypt internal chat logs eventually gave investigators a foothold.

The Unprecedented Supply‑Chain Campaign

Attack Vector Chain

1. Initial foothold – The gang compromised the CI/CD pipeline of an open‑source scanner (Trivy). By inserting a malicious step, they gained the ability to sign future releases with a trusted key.
2. Credential harvest – The compromised scanner accessed the GitHub accounts of its maintainers, extracting personal access tokens.
3. Lateral spread – Using stolen tokens, the attackers pushed malicious commits to dependent projects like Lite LLM and Tan Stack.
4. Worm deployment – Mini Shai‑Hulud, written in Go, leveraged the Go module system to automatically download and execute on any developer machine that imported the infected library.
5. Enterprise breach – The worm harvested additional credentials (e.g., Azure AD tokens) and exfiltrated data from high‑profile targets such as Open AI, the European Commission, and Mercor.

Scale of Impact

• >1,000 compromised organizations – Public disclosures list more than a thousand victims, ranging from startups to multinational agencies.
• Multiple industry sectors – The campaign spanned cloud providers, AI platforms, security tooling, and even government bodies.
• Economic cost – Early estimates suggest remediation, legal fees, and lost productivity could exceed $500 million globally.

The breadth of the attack illustrates how a single supply‑chain compromise can cascade into a worldwide security incident, echoing the lessons from earlier events like the SolarWinds breach but on a far larger, more automated scale.

Google’s Undercover Operation

Infiltration Timeline

• Early 2026 – Mandiant, Google’s security subsidiary, created a persona (“Alex R”) with a credible open‑source contribution history.
• Month 1 – “Alex” engaged with a peripheral member of Team PCP on Discord, earning an invitation to the core chat after demonstrating expertise in Go tooling.
• Month 2–3 – The undercover analyst observed the planning of the Mini Shai‑Hulud release, documented the exact code‑injection technique, and relayed findings to Google Threat Intelligence.
• Month 4 – Operational security slips by the Australian members (reuse of a personal phone number in a phishing email) gave Google the ability to map real‑world identities.
• May 2026 – Google shared actionable intelligence with affected vendors, enabling rapid patching of compromised libraries before the worm could fully propagate.

Collaboration with Law Enforcement

Google’s intelligence was pivotal for the joint Australian‑FBI operation that led to the arrests of Ruben Ian Thomson and Louis Michael Gaebler. By correlating IP logs, VPN exit nodes, and the compromised phone number, Google supplied law‑enforcement with a “digital fingerprint” that matched the two Australians to the core of Team PCP.

Role of Shiny Hunters

An unexpected ally emerged when the rival cyber‑criminal group Shiny Hunters turned on Team PCP, leaking internal chat logs that confirmed the presence of the undercover analyst. This intelligence cross‑feed accelerated Google’s ability to verify the authenticity of the persona and to anticipate the group’s next moves.

Technical Anatomy of the Mini Shai‑Hulud Worm

Mini Shai‑Hulud is a compact, self‑replicating Go binary designed to exploit the Go module proxy system. Its core functions include:

• Module hijacking – Alters go.mod files to point to a malicious proxy under the attacker’s control.
• Credential exfiltration – Reads ~/.ssh/id_rsa, ~/.git-credentials, and cloud SDK config files, encrypts them with a hard‑coded RSA key, and sends them to a C2 server.

• Persistence – Installs a systemd service (shai-hulud.service) that restarts the worm on

• Persistence – Installs a systemd service (shai‑hulud.service) that restarts the worm on boot, ensuring it survives reboots and updates.

• Lateral movement – Scans the host for additional Go projects, automatically injecting the malicious proxy configuration into any go.mod it discovers, thereby expanding its foothold without user interaction.

• Self‑update – Periodically contacts a hardened Git repository under the attackers’ control to pull newer payloads, allowing the worm to evolve its capabilities (e.g., adding ransomware modules or additional exfiltration routines) without needing a new supply‑chain compromise.

Detection and Mitigation

Google’s Threat Intelligence team released a set of actionable indicators of compromise (IOCs) within days of observing the worm’s first deployment. The key recommendations for organizations using Go modules are:

1. Pin module versions – Use go.sum verification and enable the -mod=readonly flag in CI pipelines to prevent unauthorized changes to go.mod.
2. Audit proxy settings – Verify that GOPROXY points only to trusted mirrors (e.g., proxy.golang.org) and disable fallback to direct unless explicitly required.
3. Rotate secrets – Immediately revoke and rotate any SSH keys, GitHub personal access tokens, and cloud provider credentials that may have been exposed.
4. Deploy endpoint detection – Leverage EDR solutions that can flag the creation of suspicious systemd services or the execution of unsigned Go binaries from non‑standard locations.
5. Implement supply‑chain signing – Adopt reproducible builds and sign releases with a hardware‑backed key, then enforce signature verification in downstream pipelines.

Google also contributed a Go‑module hardening plugin to the open‑source community, which automatically validates the provenance of each module before it is fetched. The plugin has already been integrated into the CI workflows of several high‑profile projects, including Trivy and Lite LLM.

Impact on the Supply‑Chain Security Landscape

The PCP campaign underscores a shift in attacker economics:

🔹 --------
• Traditional Supply‑Chain Attacks: ----------------------------------
• PCP‑Style Campaign: --------------------

🔹 *Target selection*
• Traditional Supply‑Chain Attacks: High‑value enterprises (e.g., SolarWinds)
• PCP‑Style Campaign: Widely‑used open‑source libraries

🔹 *Propagation*
• Traditional Supply‑Chain Attacks: Manual credential reuse, limited spread
• PCP‑Style Campaign: Automated worm leveraging language ecosystem

🔹 *Detection window*
• Traditional Supply‑Chain Attacks: Weeks‑to‑months
• PCP‑Style Campaign: Hours, due to self‑spreading nature

🔹 *Economic motive*
• Traditional Supply‑Chain Attacks: Extortion, espionage
• PCP‑Style Campaign: Credential harvesting for resale, ransomware‑as‑a‑service

By weaponizing the module ecosystem itself, the attackers demonstrated that the “trust” model of open‑source distribution can be subverted at scale.

Read the full breakdown originally published at https://ltdeveloperblogs.github.io/posts/an-undercover-google-analyst-infiltrated-a-notorious-supply-chain-hacking-gang/