Google Had Undercover Analyst Inside Hacking Group During Supply-Chain Attacks

Google maintained an undercover analyst inside the TeamPCP hacking group during its significant supply-chain attacks targeting open-source software, the company's threat intelligence division revealed. TeamPCP was known for infecting hundreds of programs with malware, ultimately breaching over a thousand companies. The group also deployed a Dune-themed, self-spreading worm to automate its malicious activities.

The presence of the mole allowed Google to monitor TeamPCP's operations from within, enabling the company to warn affected organizations and disrupt the group's exploitation attempts. Two alleged ringleaders of the group were arrested in Australia last month.

Austin Larsen, a researcher with Google Threat Intelligence, shared details of the investigation and infiltration at SentinelOne's LABScon conference. He stated that Google identified operational security mistakes made by alleged group members, leading to the transfer of identifying information to law enforcement. Another cybercriminal group, ShinyHunters, initially partnered with TeamPCP but later turned against them.

Google's security subsidiary, Mandiant, had an analyst embedded within the group's inner circle from nearly the beginning of its prominent activity. This internal access provided crucial insights into TeamPCP's tactics and targets, contributing to their eventual exposure and arrests.