How Google's mole infiltrated hacker gang that breached 1,000 companies
What's the story
Google's Threat Intelligence team has revealed that an undercover researcher successfully infiltrated the notorious hacking group, TeamPCP. The operation allowed Google to closely monitor the group's activities and thwart their attempts at exploiting potential victims. Austin Larsen, the undercover researcher in question, followed a trail of operational security lapses allegedly made by one of two Australians accused of being part of TeamPCP.
Information sharing
Larsen's investigation led to major breakthroughs
Larsen's investigation led to Google sharing key identifying details with law enforcement agencies.
The tech giant also got intelligence from ShinyHunters, another notorious cybercriminal group that had once collaborated with TeamPCP but later turned against them.
This information was instrumental in Google's efforts to track TeamPCP's activities and warn potential victims about their malicious intentions.
Data breach
Google warned victims of TeamPCP's attacks
Larsen's undercover work also led him to a server where TeamPCP had stored a trove of stolen credentials from its victims.
The data included usernames, passwords, and access tokens obtained through hacking.
Google used this information to warn victims and disrupt TeamPCP's attempts at exploiting the stolen credentials.
Investigators allege that TeamPCP hacked more than 1,000 corporate, academic, and government organizations worldwide, stealing 300GB of proprietary data, and harvesting over 500,000 credentials to fuel extortion schemes and crypto money laundering.
Attack prevention
Google's proactive measures thwarted potential damage
Google's insight into TeamPCP's activities also uncovered that someone within TeamPCP's core circle had a separate identity was using an AI tool to create a zero-day exploit for popular login software.
The exploit could have let hackers bypass two-factor authentication.
However, Google quickly retrieved the code and developed a hacking technique that exploited the unknown vulnerability in the software, effectively neutralizing the threat.
Extortion link
Key players in TeamPCP arrested by Australian police
On August 26, Ruben Ian Thomson (21) and Louis Michael Gaebler (23) were arrested in Perth by the Australian Federal Police for their alleged roles as principal members of the "TeamPCP" cybercrime syndicate.
Investigation by Larsen led to their identification.
Authorities linked them to a Gmail account and discovered that stolen credentials were being backed up to a Google Drive associated with the account.