Two West Australian men have been charged after a joint Australian and United States investigation into an alleged international cybercrime syndicate accused of compromising software used by more than 1,000 organisations.
The Australian Federal Police said the men, aged 21 and 23, were arrested on Wednesday after search warrants were executed at properties in Cottesloe, Hamilton Hill and Mandurah. Electronic devices and other items were seized and are now undergoing forensic examination.
Police allege malicious code entered trusted software
The investigation centres on allegations that a group known as TeamPCP inserted malicious code into software hosted on an open-source repository. Open-source components are routinely reused by developers, allowing the affected software to spread into systems operated by organisations in government, academia and the private sector, police allege.
According to the AFP, the code allegedly gave the syndicate access to computer networks and enabled it to steal sensitive information, including user credentials and authentication materials. Authorities estimate more than 500,000 credentials and at least 300 gigabytes of data were taken.
The alleged supply-chain compromise may have affected more than 1,000 organisations worldwide. Police said the cost of responding to and repairing the damage has been estimated in the hundreds of millions of dollars.
The AFP and the Federal Bureau of Investigation began parallel inquiries in April after receiving information from several cyber-threat assessment companies. Western Australia Police joined the operation, with investigators allegedly linking the two Perth-area men to principal roles in the syndicate.
Fourteen charges laid against two men
The 21-year-old Cottesloe man faces eight charges, including possessing and supplying data with the intention of committing a computer offence, unauthorised modification of data, failing to comply with an order to provide access to digital information, and dealing with proceeds of crime valued at $100,000 or more.
The 23-year-old Mandurah man faces six charges, including possession and supply of data intended for a computer offence and four counts of unauthorised modification of data with the intention of committing a serious offence.
The most serious allegation against the Cottesloe man, dealing with proceeds of crime worth at least $100,000, carries a maximum penalty of 20 years in prison. Maximum penalties are not automatic and sentencing can occur only if a person is convicted.
Police allege both men received cryptocurrency payments for their roles. The value of those payments remains under investigation. Both men were scheduled to appear in Perth Magistrates Court on Thursday.
International operation remains open
AFP Commander Graeme Marshall said information from private cyber-threat companies had been crucial to the investigation. He said international cooperation was necessary because organised cybercrime groups could attack victims across borders while attempting to conceal their identities online.
FBI Cyber Division Assistant Director Brett Leatherman identified the alleged group as TeamPCP and said the arrests demonstrated the importance of partnerships in responding to software supply-chain attacks.
Western Australia Police Acting Commander Peter Foley urged businesses and individuals to report cybercrime regardless of the size of any suspected loss. Reports can help investigators understand patterns of offending, support victims and preserve digital evidence, he said.
The investigation is continuing, and authorities have not ruled out further arrests or charges. The AFP said a large volume of seized data still needs to be examined.
Advice for organisations and individuals
Authorities have encouraged organisations to keep software and security controls up to date, monitor accounts for unusual activity and use strong, unique passphrases with multi-factor authentication. Anyone who believes they have been affected by cybercrime can lodge a report through the Australian Government’s ReportCyber service.
People concerned that their identity information has been compromised can also seek assistance from IDCARE. All allegations against the two men remain to be tested in court, and they are entitled to the presumption of innocence.
