aikido.devarticleGood riddance, TeamPCP. Now for the hard part.
A security researcher's personal reflection on the AFP/FBI/WAPF announcement that two men in their early 20s were arrested for allegedly running TeamPCP, a threat group behind a wave of 2025-2026 supply chain attacks. The piece clarifies that TeamPCP cloned the Shai-Hulud npm worm but was not behind the original Shai-Hulud/s1ngularity campaigns, and argues LLMs let relatively unsophisticated actors rapidly operationalize public exploits, widening the gap between attacker speed and institutional response time.
TL;DR Author reacts to law enforcement arresting alleged TeamPCP members, clarifying they cloned but didn't create Shai-Hulud, and warns LLMs are shrinking the gap between exploit disclosure and mass exploitation by unsophisticated actors.
Organisations named here
- Australian Federal Police
- FBI
- Shai-Hulud
- Western Australia Police Force
Techniques named here
- Worm cloning
Threat actors named here
- TeamPCP
- Shai-Hulud
- s1ngularity
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup