In a remarkable turn of events, a clandestine operation by Google has unveiled crucial details about a notorious hacking group known as TeamPCP. According to insights from Michael Fletcher, a former analyst for the Australian Federal Police and now a threat researcher, the infiltration of TeamPCP’s communications has shed light on their extensive operations, which have been described as one of the largest supply chain assaults in contemporary history.

A leaked chat message from a TeamPCP member revealed their audacious claims of achieving an unparalleled level of success within their hacking endeavors. This prompted Fletcher to seek information about monitoring the group’s activities from Google analyst Larsen, who advised caution when approaching TeamPCP as one of its members was considered a “friendly.”

In a significant breakthrough, Larsen’s team managed to access a server housing a vast collection of stolen credentials, including usernames, passwords, and access tokens. The objective was to disrupt TeamPCP’s operations and mitigate further compromises. “My thought was: How can we, as quickly as possible, disrupt their campaign before more compromises can happen?” stated Larsen, emphasizing the urgency of the situation.

Rather than alerting the companies directly associated with the compromised credentials—which would have been a lengthy process—Google initially contacted major cloud service providers like Amazon Web Services and Microsoft. The aim was to revoke the stolen credentials efficiently, preventing any exploitation. Larsen’s team sent out numerous notifications, leading to swift actions from those service providers.

Additionally, the analysis of TeamPCP’s internal discussion threads revealed the group was working on an innovative AI tool intended to create a zero-day exploit targeting widely used login software. This exploit, designed to bypass two-factor authentication mechanisms, posed significant risks. After obtaining a copy of the code, Google‘s team tested it and confirmed its functionality, ultimately alerting the software developer to the vulnerability before it could be maliciously exploited.

This incident was acknowledged in a Google case study published in May, although it refrained from disclosing the identity of TeamPCP or the specifics of how they acquired the exploit.