Two young Western Australians have been charged for their alleged key roles in a “sophisticated cybercrime syndicate” that created malicious software to rob hundreds of organisations around the world.
Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, were arrested in Perth following a joint investigation with federal and state police working alongside the US Federal Bureau of Investigation (FBI).
The FBI’s Assistant Law Enforcement Attache Dave Andish said Mr Thomson was the alleged leader of the highly organised syndicate known as TeamPCP, which police say is involved in large-scale cybercrimes including data intrusion, identity crime and cryptocurrency-based money laundering.
Police allege both men were key syndicate members and received payments in cryptocurrency for their activities.
They faced court today charged with 14 offences in total after police raided properties in Cottesloe, Hamilton Hill and Mandurah where electronic devices and other items were seized.
The men were arrested in Perth over their alleged involvment in the group. (Supplied)
Investigations began in April after the Australian Federal Police and the FBI received tip offs about the syndicate, which allegedly inserted malicious code into open source software available online that was then unwittingly used by other developers.
A sophisticated cybercrime syndicate allegedly created malicious open-source software to rob thousands of global businesses. (Pixabay: terydanphiri)
The term ‘open source’ refers to content that developers can modify and share because its design is publicly accessible.
Hundreds of organisations compromised
Police will allege the infected software made its way into computer systems across government, academic and private sector institutions, potentially compromising more than 1,000 organisations globally.
The software allegedly enabled the syndicate to infiltrate those organisations to steal or harvest sensitive data, including more than 500,000 user credentials and authentication materials.
AFP Commander Graeme Marshall said this allowed the group to allegedly impersonate legitimate users, bypass security controls and gain unauthorised access to networks and cloud environments.
Commander Marshall said this resulted in “significant” financial losses and interruptions to operations, with remediation costs estimated to be in the hundreds of millions of dollars.
He could not confirm how many individuals, businesses or countries were implicated, but confirmed some of the organisations that fell victim to the syndicate are Australian.
“It is rare to have cyber criminals of this status domestically”, he said.
“The men are internationally significant cybercrime threat actors.”
Young cybercriminals common
Commenting on the young age of the alleged offenders, Commander Marshall said it was unfortunate, but not unusual, to arrest people in their early twenties, and even high-schoolers, for cybercrime.
AI safeguards failing to keep up
“We do see a lot of young offenders involved in cybercrime … some of them are exceptionally smart,” he said.
“They’ve grown up in a cyber-native environment, and for whatever reason they’ve decided to go down that pathway.”
In court today, Mr Thomson’s lawyer flagged a bail application although it was uncertain when this might occur.
Mr Gaebler’s lawyer made no application for bail and his client was remanded in custody for his next appearance on September 18.
Police said they have already extracted 100 terabytes of data from devices seized from one address, and expect to extract much more.
They say there may be more arrests as investigations continue.
Do you know more? Contact Callum Liddelow.