AFP, FBI, and WAPF Joint Announcement: TeamPCP Arrests

I'm here today with Acting Commander Peter Foley from the West Australian Police Force and also Acting Legal Attaché Dave Andrish from the United States Federal Bureau of Investigation.

Today I can confirm two West Australian men have been charged following investigations by the AFP, the FBI, and Western Australian Police. The investigations relate to a sophisticated international cyber crime syndicate which allegedly created and inserted malicious code into open source software that infected organisations of all sizes across the globe. This resulted in financial losses and interruptions to operations.

Police will allege the men were part of this highly organised syndicate allegedly involved in large-scale cyber crime offending including data intrusion, identity crime, and cryptocurrency-based money laundering. The AFP charged the men overnight after executing search warrants in Perth yesterday with WA Police and the Federal Bureau of Investigation. The men are appearing in Perth Magistrates Court today.

Parallel investigations started in April 2026 after the AFP and the FBI received information from multiple cyber threat assessment companies. They reported a syndicate had allegedly inserted malicious code into software that was available on an open source database and was unwittingly used by developers.

Police will allege when the infected software was incorporated into the computer systems of victim organisations, it enabled the syndicate to harvest credentials, sensitive data, and authentication materials. This allowed the group to allegedly impersonate legitimate users and services, bypass security controls, and gain unauthorised access to networks and cloud environments.

Investigators will allege these capabilities enabled the syndicate to obtain significant financial benefit and facilitate further cyber crime intrusions. It is estimated the malicious code potentially compromised more than 1,000 organisations globally across government, academia, and the private sector—enabling the theft of more than half a million credentials and the exfiltration of at least 300 gigabytes of data.

The impact is extensive. To date, the financial impact includes global remediation costs for victim organisations estimated to be in the hundreds of millions of dollars. A large volume of data seized during search warrants yesterday will be forensically examined and the investigation remains ongoing. Further arrests and charges have not been ruled out.

Cyber crime knows no borders and is a growing threat globally. By leveraging connections and sharing advanced policing capabilities, the AFP and partners in Australia and internationally can amplify our impact to disrupt cyber criminals globally.

Cyber crime syndicates are becoming increasingly organised and often operate like professional businesses. But our investigators are relentless in tracking down criminals who attempt to exploit digital anonymity to attack our communities.

The information provided to authorities by threat assessment companies proved crucial to the investigations. Early reporting and sustained cooperation between the private sector and law enforcement play a critical role in supporting cyber crime investigations and minimising the impact of cyber crime.

I'll take the opportunity to thank the Federal Bureau of Investigation who also sent agents to Perth yesterday to participate in operational activity, and the West Australian Police Force for their expertise during this investigation. International collaboration is vital to protect our critical infrastructure, organisations, and ultimately our communities online.

Good afternoon. My name is Dave Andrish. I am the Federal Bureau of Investigation Assistant Legal Attaché based at the US Embassy in Canberra, Australia.

The FBI and the Australian Federal Police, with the full support of Western Australian State Police, carried out parallel investigations resulting in the arrest of Reuben Thompson, the alleged leader of the cyber criminal group known as Team PCP. A lawful search of Thompson's residence was conducted and electronic devices were seized for investigative purposes.

These actions follow a large-scale software supply chain attack launched by Team PCP in March of 2026. The group tampered with software updates for widely used development tools, hiding malicious code in routine downloads. Those updates installed malware that gave the group access to developer environments and other systems.

This arrest sends a clear message: hiding behind a screen is no shield from the rule of law. It also highlights the FBI's commitment to protecting Americans and American businesses and the strength of our partnership with Australian law enforcement agencies.

We thank the AFP and the West Australian State Police for their outstanding support, partnership, and collaboration. We urge organisations in the United States to contact their local field office if they suspect a compromise in their systems and also recommend that they review the FBI flash advisory on Team PCP actors to protect their systems. You can access this advisory on the FBI's ic3.gov website.

Today's events—the operations and warrant enforcement in Western Australia—are an opportunity to thank the partnership that we have with the FBI and the Australian Federal Police to target cyber criminals.

This highlights the prevalence of cyber crime in our community and the prevalence of cyber crime investigations which have no boundaries—both at a state, national, and international level.

West Australian Police encourage victims of cyber crime, whether they be businesses or individuals, to report on every occasion. All police agencies require this reporting so that we understand the victims of crime and what impact cyber crime has in Australia. We need the opportunity to seize devices and seize electronic evidence to understand what cyber criminals are doing, what cyber syndicates are operating, and the ability for the police to investigate, detect, and apprehend cyber criminals.

You said Mr. Thompson is the leader of Team PCP?

We will allege that the two people that are now before the courts here in Western Australia are members of that criminal syndicate responsible for significant cyber harm across the globe.

How far reaching is Team PCP? Are there members internationally as well?

We would allege that the actions of this group have compromised at least a thousand organisations globally. We have seized significant amounts of data as a result of the search warrants executed yesterday. As we review that data, which will take some time, we're likely to identify further victims.

Were governments among the victims?

We're not naming any of the victims that we know to date. We will obviously engage with those victims and then set a method for them to put in place an appropriate response depending on what that attack on them looks like.

The malware itself was inserted by Trojan Horse into trusted software. Once they had access to organisations globally, they could then use that in different ways. For example, they could have sold access to another cyber criminal group. They could have used that to exfiltrate data which might include personally identifiable information. Or they could have used it in a ransom sense to lock up an organisation's operations or to disrupt their operations.

Is it alleged for them to create this malicious code or just using it to gain access?

We would allege that that particular criminal syndicate developed the malware.

Are you able to tell us what development tools were affected by the malware?

We will not name the software or the companies, but if you go on ic3.gov and look under industry partner information, there's a flash advisory that names Team PCP and it includes their tactics, techniques, and procedures—the DNS servers that they use and the suspected IP addresses that they use.

Is there a chance that people will still be downloading these updates?

With our close partnership with the companies, they have mitigated the risk, but we cannot be certain that some copies of this software may still exist. So that's why we urge companies to go back, read the flash advisory, and conduct scans of their systems just to make sure they're on the safe side.

How many people does the FBI estimate are involved in this syndicate?

At this point, I cannot comment on this because this is a dynamic investigation, not just in the US but internationally. But we do have active investigations looking at other subjects in multiple countries.

The two men—21 and 23—seem quite young to be involved in such sophisticated attacks.

Unfortunately we do see a lot of very young offenders involved in cyber crime. It's probably a mixture of the fact that they're growing up surrounded with technology and some of them are exceptionally smart. One of the programs that we run in the Australian Cyber Crime Coordination Centre in Sydney is working with states and territories to identify young kids at risk—curious kids who are crossing the line into what is potentially criminal. We bring them together with their parents and educators to set boundaries and showcase all of the available employment opportunities that exist within the government and private sector. It's almost like a new offender diversion program.

How much data was seized?

It is significant in terms of quantum of data. As of last night, it was 100 terabytes from one particular address. We haven't finished reviewing it yet.

Would this be the most significant cyber arrest that the AFP has been involved with to date?

We work collaboratively with all of our partners domestically and internationally. But to have cyber criminals of this status domestically—that is a rare occurrence in Australia. Typically the cyber threat actors that we confront are in overseas jurisdictions where a traditional arrest and prosecution is not going to be possible, and then we use methods such as sanctions to disrupt and degrade their ability to commit further cyber crime offences. So these two we would allege are internationally significant cyber threat actors. That is a rare occurrence in Australia and having them in our jurisdiction.

Is this the first arrest in this investigation or were there others around the world?

In this particular investigation, which commenced in parallel with the FBI earlier this year, this is the first arrest.