FBI, Australian police arrest two cybercrime suspects

Two men in Western Australia have been charged following a joint investigation by Australian and U.S. authorities into an alleged international cybercrime network accused of compromising organizations through malicious code hidden inside legitimate open-source software.

Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, were arrested in Perth after law enforcement officers searched properties in Cottesloe, Hamilton Hill and Mandurah.

The pair face a combined 14 charges, while authorities have warned that additional arrests or charges could follow as investigators examine evidence seized during the raids.

Investigators allege the men were associated with TeamPCP, a cybercrime syndicate involved in unauthorized computer intrusions, identity-related offenses and cryptocurrency money laundering.

U.S. investigators have identified Thomson as the alleged leader of the group.

Authorities say the investigation began in April after information about the suspected network was shared between the Australian Federal Police and the FBI.

According to investigators, members of the alleged operation compromised legitimate open-source software by inserting malicious code into projects that developers would later download and use.

Because the software appeared trustworthy, users could unknowingly introduce the malicious code into their own systems and networks.

Investigators believe the technique may have enabled the alleged syndicate to reach organizations across government, academic and commercial sectors.

More than 1,000 organizations around the world may have been affected, according to Australian authorities.

Investigators also allege that the operation resulted in the theft or collection of more than 500,000 credentials and authentication-related records.

Such information can potentially allow criminals to impersonate legitimate users, circumvent security protections and gain unauthorized access to corporate networks and cloud-based systems.

AFP Commander Graham Marshall described the suspects as internationally significant cybercrime threat actors and said the alleged activity had created substantial financial and operational damage.

Authorities estimate that organizations could face remediation expenses running into hundreds of millions of dollars as they work to identify compromised systems and secure affected accounts.

The FBI said the arrests demonstrate the increasing ability of international law enforcement agencies to track cybercriminals despite their attempts to conceal their identities online.

FBI Deputy Law Enforcement Attaché Daud Andish emphasized that cooperation between Australian and American investigators was critical because cybercrime networks can operate across multiple jurisdictions.

During searches of the properties, police seized electronic devices believed to contain evidence connected to the investigation.

Authorities said investigators had already extracted roughly 100 terabytes of data from devices recovered at one location and expected to uncover substantially more information.

The case illustrates the growing threat posed by software supply-chain attacks, in which criminals infiltrate trusted software or development systems instead of directly attacking individual victims.

Such attacks can be particularly damaging because a single compromised software package can potentially reach thousands of downstream users.

Thomson’s bail application was withdrawn after a magistrate raised concerns about the possibility of evidence being tampered with.

Gaebler did not seek bail and was remanded in custody until his next court appearance, scheduled for September 18.

Authorities say the investigation remains active and that the full scale of the alleged operation is still being assessed.

The case also highlights how international cybercrime investigations increasingly depend on cooperation between law enforcement agencies in different countries.

With digital infrastructure connecting businesses, governments and individuals across borders, investigators say criminal groups can cause widespread damage from a relatively small number of locations.

The Australian and U.S. agencies involved in the investigation are continuing to examine the seized data and digital evidence as they work to identify additional victims, collaborators and potential suspects.