Google analyst infiltrates TeamPCP hackers to gather evidence

Google’s threat‑intelligence unit confirmed that it had a spy inside the inner circle of the supply‑chain hacking group TeamPCP, a claim that came out of a brief statement issued on Tuesday. The analyst was reportedly embedded within the gang for several months, gathering evidence that could help trace the group’s operations and expose its members. The disclosure was made by Google’s Cyber Threat Intelligence (GCTI) team, which said the mole was placed there after an internal investigation flagged suspicious activity linked to the group’s recent attacks.

TeamPCP has been on the radar of security firms and law‑enforcement agencies for nearly a year. The gang is known for compromising software supply chains, inserting malicious code into legitimate code repositories, and then distributing the tainted software to thousands of unsuspecting customers. In 2023, TeamPCP was linked to a major breach that affected a leading cloud‑storage provider, causing an estimated $150 million in damages and forcing the company to roll out emergency patches. The group’s tactics mirror those used by the more infamous SolarWinds actors, but TeamPCP has operated from a more decentralized structure, making it harder for law‑enforcement to track.

The analyst’s infiltration reportedly allowed GCTI to collect hard‑copy evidence, including encrypted communication logs and details of the gang’s operational hierarchy. Google said it will share the findings with partner organizations and relevant national‑security agencies. The company also announced plans to enhance its own supply‑chain monitoring tools, using the intelligence gained to harden the defenses of software vendors that are frequent targets of TeamPCP. Industry experts say the move could help close a critical blind spot in the cybersecurity ecosystem, where supply‑chain attacks are increasingly the preferred attack vector for sophisticated threat actors.

In the coming weeks, Google expects to publish a detailed technical report outlining the methods used by TeamPCP, along with a set of best‑practice recommendations for vendors. The company also plans to coordinate a joint task force with the FBI’s Cyber Division and the European Union’s Cybersecurity Agency to pursue legal action against the group’s members. If successful, the operation could set a precedent for how private‑sector intelligence can be leveraged to combat state‑sponsored or financially motivated hacking collectives. The broader cybersecurity community will be watching closely to see whether this cooperation signals a turning point in the fight against supply‑chain attacks.