- Published on
Google security researcher goes undercover in hacker group TeamPCP to gather intel and sabotage from within
- Authors
- Name
- DeepHorus
A security researcher at Mandiant, a security company owned by Google, was recently revealed to have long been embedded undercover in the core chat group of the hacker group TeamPCP, monitoring from within and disrupting the group's supply chain attacks targeting the open-source software ecosystem. The news was disclosed during a security conference held by Google's threat intelligence team. During the undercover operation, Google was able to assist affected companies in handling stolen credentials before attacks occurred, significantly reducing potential losses.
To infiltrate the hacker group, Google's security team spent a considerable amount of time building a virtual persona and gradually established trust with a hacker who had been invited to join TeamPCP. Leveraging this relationship, the undercover analyst successfully gained access to the core chat group, which had only 12 members. Members of the group mainly discussed attack progress, stolen data, and subsequent extortion plans. The worm developed by TeamPCP could infect a large number of applications in a short period, steal sensitive corporate data, and threaten to make the data public to demand ransom.
The undercover analyst discovered that the hackers stored a large number of usernames, passwords, and access credentials on a single server. After obtaining this lead, Google's security team did not notify affected companies one by one, but instead directly contacted Amazon AWS to revoke all leaked credentials in bulk. This approach greatly improved response efficiency and avoided large-scale credential abuse. Subsequently, Google sent emails to the victim companies, helping them quickly rotate credentials and tighten access permissions, so that the hackers could no longer use the leaked credentials to enter corporate internal systems.
Throughout the entire undercover operation, the analyst never participated in any attack activities, and was only responsible for gathering intelligence and disrupting the hackers' plans. Google stated that the undercover operation helped it gain a large amount of internal information about TeamPCP, including attack methods, infrastructure, and member habits. More importantly, based on the hackers' operational mistakes in the chat group, the undercover analyst provided law enforcement agencies with key clues related to suspected members.
TeamPCP members are scattered across multiple countries, communicating with each other over the internet without knowing each other's real identities. Previously, the U.S. Federal Bureau of Investigation, in cooperation with Australian police, arrested two core TeamPCP members in Australia. Although Google did not explicitly state it, the public generally believes that the arrests of these two individuals were closely related to the clues provided by the undercover analyst.
This undercover operation demonstrated a new model in which security companies take the initiative to go behind enemy lines to combat cybercrime. By lurking inside hacker groups, security teams can not only provide early warnings but also directly weaken attackers' capabilities. As supply chain attacks become increasingly rampant, this kind of "insider" defense strategy may become an important trend in the cybersecurity industry. Google stated that it will continue to cooperate with law enforcement agencies and cloud service providers to jointly safeguard the security of the open-source ecosystem.
