Google’s Covert Agent Infiltrates a Major Supply-Chain Hacking Syndicate

One TeamPCP member stated in leaked chats, “You guys should understand that we pulled off the biggest supply chain hack maybe ever recorded in modern history.”

Michael Fletcher, a former Australian Federal Police analyst currently working in the threat research division of an Australian telecom company, says he approached Larsen around that time to discuss monitoring the group’s members and activities. According to Fletcher, Larsen advised him to proceed with caution, noting that one of the hackers was a “friendly.” Fletcher recalls thinking, “Damn, you all have been inside this early.”

Larsen, Google’s undercover analyst, claims he gained access to a server where TeamPCP stored a trove of credentials stolen from numerous victims, including usernames, passwords, and access tokens obtained through their hacking operations, which they seemingly planned to use for extortion. Consequently, Google’s team decided to intervene to warn victims and dismantle TeamPCP’s ransom scheme. Larsen stated, “My thought was: How can we, as quickly as possible, disrupt their campaign before more compromises can happen? Let’s go mess up what they’re doing. That was my goal.”

Rather than directly alerting the owners of the compromised credentials at victim companies—a process Larsen says would have been too slow given the massive number of breached organizations—Google first contacted providers where those credentials could be exploited, such as Amazon Web Services and Microsoft, to have them revoked and prevent the hackers from using them. Larsen and his team dispatched hundreds of notification emails to these providers and subsequently to the victims, many of which received immediate responses.

Concurrently, Larsen says Google’s visibility into the TeamPCP internal chat revealed that an individual within the group’s core circle was utilizing an AI tool to develop a zero-day exploit in a widely used login software, distinct from the group’s supply-chain operations. This exploit would allow the hackers to bypass the software’s two-factor authentication. Google’s team obtained the exploit code, tested it, and found that minor tweaks made it functional—a rare instance of an AI-generated hacking technique operating in the wild that exploited a previously unknown software vulnerability. Google notified the software’s developer, who successfully patched the security flaw. (This incident was detailed in a case study Google released in May, though it did not name TeamPCP or explain how Google discovered the exploit.)

Source link