GoKawiilGoogle threat analyst secretly monitored TeamPCP hacking group's internal operations
A Google Threat Intelligence Group analyst named Larsen ran a covert operation to observe the hacker collective TeamPCP, gaining access to a server where the group stored stolen credentials from numerous victim companies. Google used this visibility to rapidly notify cloud providers like AWS and Microsoft to revoke compromised access tokens before the hackers could exploit them for extortion, rather than trying to contact each victim individually.
GoKawiil's interpretation of the reporting above, not reported fact.
This shows how threat intelligence firms are increasingly embedding themselves inside criminal infrastructure to disrupt attacks proactively rather than reactively. Speed mattered because notifying every victim organization directly would have taken too long to stop a coordinated supply-chain extortion scheme, revealing how defenders now must move at the same pace as attackers by targeting shared infrastructure providers.
- Google's analyst infiltrated TeamPCP and accessed its stolen-credential server directly.
- Google alerted cloud providers like AWS and Microsoft first to revoke access before contacting individual victims.
- The group was also reportedly developing an AI-assisted zero-day exploit targeting widely used login software.
YubiKey 5C NFC Security Key — With supply-chain hackers hunting for stolen credentials and access tokens, hardware-based multi-factor authentication is one of the best defenses against account takeover. The YubiKey lets you secure logins with a physical key that phishing and credential-stuffing attacks can't replicate. It's a practical step anyone can take after reading about groups like TeamPCP harvesting passwords at scale.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-09-20
Published there as: “An undercover Google analyst infiltrated a notorious supply-chain hacking gang”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.