AFP charges two Perth men over poisoned packages police say reached 1000 organisations
Police allege a small number of trusted components carried the compromise into more than 1000 organisations, and the charge sheet puts the heaviest sentencing exposure on the money laundering count, well above anything tied to the code itself.
The Engineer · Build desk
What happened
- The AFP charged two Western Australian men on 26 August 2026 with 14 offences between them, after search warrants in Perth executed with the state police force and assistance from the FBI.
- The case opened in April 2026, when the AFP and FBI received information from multiple cyber threat assessment companies about code allegedly inserted into software hosted on an open-source repository.
- Investigators say they have already extracted 100 terabytes of data from devices seized at a single address, and expect to extract considerably more.
Why it matters
- cost On the lowest reading of the AFP's remediation estimate, the cleanup runs to roughly $200,000 per affected organisation, and the downstream victim absorbs every dollar of it while the accused bear none of the cost.
- constraint With no repository, ecosystem or package names published and a trial possibly more than 18 months out, a team cannot check its own exposure against this case; defensive work has to be indicator-independent.
- exposure Marshall confirmed some victims are Australian but could not say how many organisations or countries are implicated, so an unknown number of the counted victims have not been told they are in the tally.
- precedent Charging package poisoning under the identity crime provision alongside a proceeds of crime count sets a template for building the next such case on credential theft and crypto tracing evidence, extending well beyond intrusion evidence alone.
The load-bearing phrase in the AFP release is "a small number of trusted software components" [7]. That is the whole mechanism. A poisoned release does not need to be popular to be everywhere; it needs to be resolved. Once it is in a lockfile or somewhere in a transitive closure, install-time and build-time code runs wherever the package is fetched, which in most shops is a CI agent holding registry tokens, cloud role credentials and signing material. The alleged haul matches that environment: user credentials and authentication materials [5]. AFP Commander Graeme Marshall described the second stage as impersonating legitimate users, bypassing security controls and reaching networks and cloud environments [10]. Stolen tokens are valid tokens.
Treat the impact figures as claims about someone else's telemetry. Police estimate more than 1000 organisations potentially compromised, more than 500,000 credentials taken and at least 300 gigabytes exfiltrated [6]. Divide it out and the average victim lost roughly 500 credentials [22] and about 300 megabytes [23]. That average is almost certainly not the shape of the distribution; a few build systems with wide reach would account for most of both totals. The qualifiers matter too, since "potentially" sits on the organisation count and "at least" sits on the bytes [6]. The ABC's own summary says hundreds of organisations while its body carries the police figure of more than 1000 [13]. For 1000 to mean 1000 intrusions rather than 1000 installs of a bad version, someone would have to publish per-organisation confirmation.
The charge sheet is the more useful document. Against the 21-year-old from Cottesloe: possessing data with intent, maximum three years; four counts of unauthorised modification of data with intent to commit a serious offence, five years; supplying data with intent, three years; failing to comply with a 3LA assistance order, ten years; and dealing with proceeds of crime worth $100,000 or more, twenty years [15]. The proceeds count carries four times the maximum of the heaviest computer offence charged, and the assistance-order count twice it [25]. On the face of that arithmetic, keeping the password is dearer than modifying the data. The 23-year-old from Mandurah faces the six computer counts and nothing further [16]. Police allege both men were principal participants paid in cryptocurrency, with the value still under investigation [8].
Scale shows up in the evidence pile rather than the theft. Investigators say they have already extracted 100 terabytes from devices seized at one address and expect much more [11], which is on the order of 330 times the exfiltration figure they have put on the syndicate [21]. The magistrate refused Ruben Thomson bail on the concern that he could tamper with evidence, and his lawyer withdrew the application [19]. Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, were named by the ABC [17], and the FBI's Assistant Law Enforcement Attache Dave Andish identified Thomson as the alleged leader of the group known as TeamPCP [9]. What that adds up to, from a defender's seat, is a case whose critical path runs through forensic extraction, with attribution trailing well behind it.
What to watch
- Whether anyone publishes the repository, package names and affected version ranges: the AFP, the FBI, or the threat assessment companies whose information opened the case.
- Gaebler's 18 September appearance, and whether the further charges the prosecutor flagged are actually laid.
- Whether later forensic passes over the seized devices revise the 300 gigabyte and 500,000 credential estimates.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption41
- Hype gap+26
- Incentives72
- Confidence63
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The AFP charged two Western Australian men on 26 August 2026 with a combined total of 14 offences, after executing search warrants in Perth with the Western Australia Police Force and assistance from the FBI.
- [2]
Both men were scheduled to appear in Perth Magistrates Court on 27 August 2026.
- [3]
Search warrants were executed at properties in Cottesloe, Hamilton Hill and Mandurah; both men were arrested and electronic devices and other items were seized for forensic analysis.
- [4]
Parallel AFP and FBI investigations started in April 2026 after both agencies received information from multiple cyber threat assessment companies about a syndicate that allegedly inserted malicious code into software available on an open-source repository, which was then unwittingly used by other developers.
- [5]
Police allege the infected software was distributed into computer systems at organisations across government, academia and the private sector, enabling the syndicate to steal or harvest sensitive data including user credentials and authentication materials.
- [6]
The AFP estimates the malicious code potentially compromised more than 1000 organisations globally, enabling theft of more than 500,000 credentials and exfiltration of at least 300 gigabytes of data.
- [7]
The AFP release states that "the alleged compromise of a small number of trusted software components had a significant global impact" and that global remediation costs are estimated to be hundreds of millions of dollars.
- [8]
Police allege the two WA men were principal participants in the syndicate's activities and received payments in cryptocurrency for their roles, the value of which is still under investigation.
- [9]
The FBI's Assistant Law Enforcement Attache Dave Andish said Thomson was the alleged leader of the highly organised syndicate known as TeamPCP.
- [10]
AFP Commander Graeme Marshall said the harvested credentials allowed the group to allegedly impersonate legitimate users, bypass security controls and gain unauthorised access to networks and cloud environments.
- [11]
Police said they have already extracted 100 terabytes of data from devices seized from one address and expect to extract much more.
- [12]
The prosecutor described the men as "masterminds" in the offending and said further charges were likely; police say there may be more arrests as investigations continue.
- [13]
The ABC's "In short" summary says the men allegedly compromised hundreds of organisations, while the same article's body reports police alleging potentially more than 1000 organisations globally.
- [14]
Neither the AFP release nor the ABC report names the open-source repository, the ecosystem, or the affected software components; the AFP refers only to "an open-source repository" and "a small number of trusted software components".
- [15]
The 21-year-old Cottesloe man was charged with one count of possessing data with intent to commit a computer offence (maximum three years), four counts of unauthorised modification of data with intention to commit a serious offence under sections 477.1 and 372.1 (maximum five years), one count of supplying data with intent to commit a computer offence (maximum three years), one count of failing to comply with a 3LA order under the Crimes Act 1914 (maximum 10 years), and one count of dealing with proceeds of crime worth $100,000 or more (maximum 20 years).
- [16]
The 23-year-old Mandurah man was charged with one count of possessing data with intent (maximum three years), four counts of unauthorised modification of data with intention to commit a serious offence (maximum five years), and one count of supplying data with intent (maximum three years).
- [17]
The ABC named the two arrested men as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23.
- [18]
Marshall said some of the organisations that fell victim to the syndicate are Australian, but he could not confirm how many individuals, businesses or countries were implicated.
- [19]
The magistrate said she would not grant Thomson bail, expressing concern he could tamper with evidence; his lawyer withdrew the bail application. Gaebler made no bail application and was remanded in custody for his next appearance on 18 September.
- [20]
Thomson's lawyer Nick Scerri told the court a trial could be more than 18 months away.
- [21]
The 100 terabytes already extracted from devices at one address is roughly 330 times the at-least-300-gigabyte exfiltration figure police attribute to the syndicate.
- [22]
Averaged across the estimated victim count, the alleged credential theft works out at roughly 500 credentials per compromised organisation.
- [23]
Averaged across the estimated victim count, the alleged exfiltration works out at about 300 megabytes per compromised organisation.
- [24]
On the lowest reading of "hundreds of millions of dollars" (200 million) spread over the estimated 1000 affected organisations, remediation is on the order of $200,000 per organisation.
- [25]
The proceeds of crime count carries a maximum four times that of the heaviest computer offence charged, and the 3LA non-compliance count carries twice that maximum.
Sources
2 independent publishers whose own reporting we read for this story.
- abc.net.auTwo Perth hackers charged after major AFP, FBI investigation into alleged global cybercrime - ABC News
1 article · August 27, 2026
- Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate
afp.gov.au
1 article · August 28, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Cryptocurrency-based money launderingFollow
- Software Supply Chain SecurityFollow
- Cybercrime EnforcementFollow
- Open-source package repositoriesFollow
- Cross-border police cooperationFollow
- Credential Theft and Stealer LogsFollow
Entities
- Perth Magistrates CourtFollow
- Louis Michael GaeblerFollow
- Nick ScerriFollow
- Ruben Ian ThomsonFollow
- Dave AndishFollow
- Federal Bureau of InvestigationFollow
- TeamPCPFollow
- Section 3LA, Crimes Act 1914Follow
- Graeme MarshallFollow
- Criminal Code (Cth)Follow
- Australian Federal PoliceFollow
- Western Australia Police ForceFollow