How Brian Krebs doxxed TeamPCP

0:04James Wilson: Hey everyone, I'm James Wilson and welcome to this Team PCP focused episode of Risky Business Features. Today we are chatting with veteran cybersecurity journalist Brian Krebs of Krebs on security.com. Yesterday, two men were arrested in Perth here in Australia over their alleged links to the Team PCP supply chain attacks. And so who better to join the show to talk about this than Brian Krebs. He's been investigating Team PCP since late last year, and in this interview he'll explain how he connected various online identities to the Team PCP hacks, and from there how he then connected those online identities to some real world identities.

0:46James Wilson: Now folks, it's very important to remember that everything we're talking about here is alleged, not proven. Just because someone is charged with a crime, it does not mean they actually committed it. So do keep that in mind. So in this episode, we're going to talk about Brian's contacts with Team PCP members, how the group was formed, and how Brian connected a bunch of dots together to figure out who these people might be. I'm going to drop you in here into the interview where Brian talks about the early conversations he had with Team PCP's self-styled spokesperson, Ellis, who in the end turned out to be much more than just the group's mouthpiece.

1:26James Wilson: Enjoy. Right, at the time we were chatting, I was asking him a lot of questions about what he had gotten out of his participation with Team PCP and what he thought was good about it and if he would have done anything differently, he'd given another opportunity. You know, those kind of open-ended questions. and he was pretty open about his motivations, which he claimed were just a distraction from some of the things that he's been trying to get away from for a long time, like drugs and, you know, just a scene that's just not good for him. Of course, he didn't really, he didn't manage to escape the clutches of the drugs as far as I could tell.

2:19But at one point, at around that point, he started talking about what he wanted, you know, how he wanted to end things. He didn't want, he wanted to go out on his own terms. And at that point, you know, he got really solemn and very kind of sullen about his life. And at that point, pretty much everything he said to me sounded like something you'd see in a suicide note, you know. Um, yeah, and it was, it was pretty dark and, and, uh, he was really unhappy with his life and he didn't see, he, I think he realized he'd made, I didn't share with him by the way that I knew who he was in real life. At one point I asked him, uh, you know, what would you say if, if I told you I knew who you were, but I never told him that.

3:11Um, but I think he understood that he'd made a certain number of, you know, operational security mistakes that were going to catch up with him. And he was really kind of despondent about that.

3:23James Wilson: Yeah. And important to remember here that we're talking about an individual that you identified at the time you knew Ms. Ellis. There's signals and reason to believe that they may be one of these people that have been picked up by the Australian Federal Police yesterday in Perth. And of course, all of this is, you know, these are all alleged involvements per the press release from the police but it's it's it's just super interesting that this actor to me has never felt like your more traditional hardened cybercrime member uh you know even some of the things you noted here in terms of you know they claimed that they only made about twenty thousand dollars out of their involvement with team pcp that just seems like a phenomenally small amount given the scale of what they're involved in.

4:11James Wilson: Like what's your sense of the character of the person that you met in this signal chat versus, I guess, the people you've met that have maybe different qualities? Yeah, I didn't get a sense that there was any appreciation they had for the scale of the damage or the disruption that they were causing. Um, yeah, I, I think Rubin was motivated by a desire to make things happen, uh, and to see what happened when they pushed things, uh, and saw, you know, how far they could push things. and really I think that was the bulk of his motivation beyond something he came back to a lot which was the camaraderie and the community that he found there and for me I come back to, well, a few things, a few themes from this and one is something that Ruben brought up a number of times in our conversations because it came up so often in his conversations with other members and in their public chats, on the Matrix chats.

5:24And that was just the theme of how many people in their group were struggling with serious narcotics abuse issues. And so that in and of itself, the abuse of hard drugs and pretty mind-altering drugs, It's not necessarily a strange thing for cybercriminals. In fact, it's really common. But with this group especially, I think you have, I don't know, almost like a devil-may-care attitude about not only protecting their own identity, but what their consequences of their actions may be. So in that respect, I think they're kind of – they're not that strange of a beast. But they are different in a sense, I think, that they were never any of them, it doesn't seem.

6:27The Team PCP group, those core guys, I don't know that they were ever focused on the kinds of things that you see. English-speaking threat actors getting really excited about, which is status within the community or making a lot of money or proving that they achieved a certain success by whatever measurement it is, that the community or the calm of English-speaking cybercriminers tends to focus on what is the metric for success. So I don't think that they were ever focused on that.

7:06James Wilson: You mentioned an individual there, Ruben, which I'm assuming is referring to Ruben Thompson now. That was one of the two people that were arrested in Perth yesterday. The police didn't release the names of them, but since then, various media outlets have confirmed that one individual was Ruben Thompson. The other one was, I believe, a gentleman named Michael Gabler. Is that right? Those are the two people that have come out in the media? That's correct. Yeah. so you know and again we've got to be careful here because this is we'll talk about how you draw the connection between the person you were talking to as alice their relation these sort of things that give you reason to believe that that is reuben thompson and all the things you mentioned there about drug use is something that they told you in that signal chat but you also talked a little bit there about the fact this this community this group and and when i was reading your article that you've now published, there's an interesting sort of formation here of this group coming together.

8:02James Wilson: And it centers around this matrix chat group that was started by someone called George Prepicus. And so let's maybe just start there at like this formation of this matrix chat group. Who is George Prepicus? Who did this form? Who did it attract? And what was, I guess, the function of this matrix chat group initially? So George Prepicus, I don't know if that's the correct pronouncing the issues of his name, he uses a Twitter profile handle, Colonel Stub. And, you know, this is a guy who's been pretty active in the malware research scene for several years. He's competed and done quite well in own-to-own and, you know, those kind of hacking competitions and bug bounties and things.

8:50So he's an accomplished security researcher that kind of just doesn't have a filter. The guy just seems to churn out exploit code and new discoveries and vulnerabilities all the time. But he doesn't seem to get too caught up in how those bugs are handled or who handles them or what. He just kind of drops them. and sometimes it's on like, I saw him on LinkedIn a couple of weeks ago, a little less than a couple of weeks ago. He was posting something right before we went on like a two-week vacation. He's like, hey, I'm just posting this Apache RCE or something like that. It was like, you know, code execution vulnerability and it really widely used, he's a software and he's like, Send me some comments or tell me what you think.

9:52Meanwhile, threat actors are free to use this. And I'm going on vacation. Yeah, so he set up this matrix server dubbed the CyberCats. And I don't know if he created it for the Team PCP and friends or if he created it and then they just showed up. But I have to think that the people on the server created their own corresponding accounts, very similar names that were on these major chats, as names on Twitter accounts. And they've been talking about what they're chatting about in these major chats on Twitter as well. And ColonelSub is no exception there. So I have to think that maybe this was set up for them.

10:43In any case, they've been using this matrix server to chat pretty openly for the past couple, two and a half months or so at least. And it's been interesting to be in there because it's a mix of what you would expect, right? A bunch of journalists lurking and security researchers and threat actors. And, you know, there are some pretty interesting cats, I should say, in that chat.

11:16James Wilson: Which, and this is where maybe it's good to spell out a little bit of the timeline here, because there's a couple of question marks I still have around this, because you were chatting with this individual, Ellis, even just up to a couple of weeks ago, and in, I think, from July onwards. but when you were first talking to them they'd said that they had wrapped up their involvement with team pcp in march which would be before all the big things sort of kicked off right light llm was not till late in march then there was trivy then there was the github compromise and and this matrix server you mentioned was active over the last couple of months so help me kind of understand i guess we start with this individual ellis do you think they were originally founder or the leader of Team PCP?

12:02James Wilson: Did they really step back in March? Yeah, I think Prubin was kind of in on the ground floor, as it were, with this group. And when they started some of their supply chain shenanigans late last year, I think he was definitely a driving force with this group. And I tend to believe him. I mean, he was pretty straight with me, I think, in our chats. I never got the sense that he was lying to me. When did the Matrix chat actually get created? And talk to you about some of the other actors that we saw in there. Because I think there was also SeesawSec, which is FulcrumSec, PCP Casper. Yeah, there's about 32 images, files that are open on my Mac right now.

12:50And I don't know which one of them has it. But somewhere there's a screenshot of Colonel Stubb inviting these guys. I don't know when it was created. But the other question you had was who else is on it?

13:05James Wilson: Yeah, yeah. There were some other actors in there, right? Yeah, yeah, yeah. And so, you know, some of this has been difficult to tease apart. You know, it's not always clear. First of all, Ruben was constantly using different nicknames or changing his nickname. So it wasn't always clear what he was involved with. But I think he was being truthful when he said he stepped away from the day-to-day stuff earlier this year. Um, it only because it's clear from looking at the, at the other members on the chat, constantly asking like, where the heck is, you know, team PCP? Oh yeah, I heard he was, you know, sleeping something off, you know, whatever.

13:54So, I mean, you can't run a cybercrime, you know, organization if you're just completely zonked out all the time, which he was. So I don't – I'm not going to say he wasn't involved in cybercrime and doing illegal stuff. I think he was up until he got arrested. But I don't think he was like pulling the strings or anything at that point. But it was interesting because some of these guys had similar nicknames. like there was another guy on on the matrix chat uh pcp uh not pcp cat pcp casper see i'm mixing them up uh and he had a twitter account where he talked about a lot of the same things uh this this individual uh who's apparently one of the the people was arrested uh in the last 24 hours was at at some point i started really digging into them and i and i thought well look at this They've got, you know, I don't know what it was, many thousands of messages over the last two years on Telegram.

15:01And, I mean, they were going off at every opportunity they could to talk about the Nazis and how great they were, you know, and the Nazi party there in Australia. And I was just kind of blown away by how easy it was to figure out where this guy's hometown was just by looking at the stuff he was posting. So that didn't surprise me at all that he's one of the individuals arrested because along with the other guy, Ruben, neither of them had any OPSEC as far as I can tell.

15:40James Wilson: that's a good segue into the opsec part here because when i read your teardown of you know the various aliases that you found the first link to um jewel residents in south africa and australia then tracing that australia link um talk me through i guess the you know how does this thread unravel where do you where did you start pulling and where did it take you down the rabbit hole? You know, I started pulling just as I usually do on the forum names, the usual stuff, just whatever they happen to post as identifying information. And then in addition to that, any kind of details they share about their personal life or their challenges or whatever they're interested in, all those things can be useful.

16:29And, but, you know, at some point I ran into a wall in my research and I thought, well, I think it's this guy, but I mean, I can't, you know, I can't hang anything on this. This is weak sauce, right? And I thought there's got to be something I'm missing here. And I think I went back and forth a couple of times. And then I thought, oh gosh, you know, historic DNS. I mean, this is, I forgot I hadn't done any historic DNS lookups on any of the IP addresses that were tied to the, you know, to the forum nicknames that I knew he had used. And I mean, you know, that you could see he had used if you were able to connect one handle change to another, which wasn't that hard in his case.

17:18So until I started doing that passive DNS, us, I was just kind of, you know, 70, feeling like I was 70 % there.

17:26James Wilson: But yeah, after that, after I was able to detect that one of the IPs that he used to access one of the cybercrime forums traced back to a family that had a, you know, one home email and internet domain attached to the entire family's email addresses and everything. So they had been at these IP addresses for over three years in some cases. And just pivoting on that, once I figured that the last name of the person I was looking at, it became, it was just a matter of time after that. I mean, just, you know, pulling on threads and chasing down more stuff. That's where it seems this really exploded for you.

18:24James Wilson: You found that family domain name from various sources like Facebook, et cetera. You were able to find other family members. This is when you sort of draw this connection back to an individual called Ruben, which you assume is Ruben Thompson, one of the people that was arrested yesterday and alleged to be involved with Team PCP. But I found it interesting just the depths that you go to in terms of, you know, it's not just the cybercrime forums. You're looking at things like Airbnb accounts, which I found interesting that here that you found an Airbnb account, again, linked to an individual named Ruben Thompson.

18:59James Wilson: And he actually described himself as a web developer who went to school at University of Western Australia. and that's when you sort of drew the connection back to Ellis, right? Because he says in the Airbnb profile that his friends know him as Ellis. Was that a bit of an aha moment? Oh, it absolutely was. And I couldn't believe it. And then I thought, well, all right, what about this domain that is tied to the entire family's email addresses? Because they all had domains in it. And started looking into that and found just a ridiculous number of forum accounts associated with the passwords and the IP addresses used to access those accounts.

19:48So that is just, it was a staggering amount of information. And as soon as we got the passive DNS stuff, the rest of it took care of itself.

19:58James Wilson: I was imagining that that was a bit of a personally exciting moment of like, oh, dots finally line up. It was because at that point I thought, well, we should kind of check to see what is this domain? What is this family domain? Is it a business? And sure enough, it was tied to a business. But then I found, yeah, it's not only tied to a business, but it's tied to at least three different businesses that are in this kid's name, including one called OpSec Express, which I found, when I found that, I think I laughed for about five minutes straight. I thought that was the funniest thing I'd ever heard because Express was one of the nicknames he'd used on the forums.

20:38And I thought, well, if you're going to sell a service that ostensibly tries to teach people how not to get caught for their crimes, maybe don't use your forum nickname as your company name. Yeah.

20:52James Wilson: I mean, it really feels like there is just so many OPSEC failures here. On the scale of OPSEC failures that you see, is this like one of the most ridiculous, egregious, complete and utter fails of OPSEC? Or were there some measures that he tried to conceal his identity? How does this rank amongst the OPSEC fails that you've seen a lot of. Yeah, it's up there. I mean, I honestly think that he just stopped caring about the consequences or his own OPSEC or anything like that, almost from the very beginning. Because, you know, if you're going to do that kind of thing, it's not super difficult. well let's just put it this way it's a lot easier to do if you don't recycle your identities right you just start over um but that's really difficult for people in this community to do especially if they're relatively unknown you know uh and they they feel like they've they've gained some kind of uh some kind of currency in that community So I think, you know, to some degree, he can say he wasn't part of the comm and he wasn't part of that community.

22:15But he absolutely was. And he was, you know, on these communities selling services to people in those communities. So I would say, you know, it wasn't that much of an aberration.

22:27James Wilson: Yeah, yeah. In that respect. And so, you know, and again, I'm being careful here to make sure that we're very transparent that what we're talking about here is your observations of an individual that you've been observing, that various signals lead you to believe that there is a plausible link to this individual, Reuben Thompson, who was arrested yesterday, alleged to be a member of Team PCP, and we'll let the legal process sort out all of that in due course. But one thing that we, I guess, can talk to in concrete is you mentioned there that this individual seems to have had very little regard for the consequences of their actions.

23:08James Wilson: But outside of the negative consequences of their actions, there's actually been some positive outcomes of this in terms of, you know, they really did make the industry kind of wake up to the dumpster fire that we've all known the package registry system is for a long time. But they kind of lit the dumpster fire and said, look, it's on fire. You better go and put it out. So, you know, what can you say about the, I guess, the lasting good that's transpired out of this? Yeah, I can't argue with that at all. I mean, I think it's important to point out something I actually mentioned in the story was Charlie Erickson and Akita Security was talking about when he was discussing Team PCP.

23:47And, you know, it feels on target. And that is it, you know, say what you will about the havoc that Team PCP caused and, you know, countless code pipelines and the endless credentials that they stole from half of the Fortune 500. But they really did move, you know, they did a lot to move the needle on supply chain security, at least as it relates to, like, you know, how most programmers and code maintainers, et cetera, interact with platforms like NPM and GitHub. So, and in that sense, you know, their actions and repeated success at just, you know, pantsing GitHub and the entire community over and over again, I think, you know, really did push Microsoft to do the right thing.

24:39And you've seen the same kind of shifts with the introduction of cool-down periods in NPM and other places where the public code repositories. Yeah.

24:54James Wilson: I mean, it's good steps that I don't think would have been taken or given the prioritization if it weren't for these successive campaigns. But on the flip side, you know, alongside that lasting good, there is still a lingering threat of this stockpile of creds. Where is it? Who's got it? And so I guess to wrap up, Brian, we'll let the legal process play out now for these two individuals that have been arrested yesterday in Perth. But what's your sense of what becomes now of Team PCP, supply chain attacks? I'm sure it'd be foolish to say we've seen the end of this, but I wonder if you have any sense of where this goes from here.

25:35As much work as this story was for me, it really only scratches the surface of a much, much bigger series of stories. And I think, I hope to be able to share some of those in the coming weeks and months. You know, again, some of that is out of my hands in terms of, you know, timing. But look, there are a number of untold stories here that are really important, one of which is untangling the role of shiny hunters within this group, which I don't know if I'm sharing something scooby here, but not very long ago at all, I think it was a couple weeks ago, they completely hacked Team PCP. and got access to their internal conversations and stole all kinds of data that they stole, ended up sharing that information with law enforcement and a bunch of people in the research community.

26:41And so, you know, there was a period when one of the hackers involved in Team PCP, a Middle Eastern guy goes by the handle Pricks who's been doxed pretty thoroughly. he invited a shiny hunters member to join the group and that member ended up just downloading all tp stuff and leaking it so um you know i i don't want to get too far into that story because you know it feeds into some other reporting i'm doing but you know that was a pretty interesting wrinkle i thought and that you know the other thing that i think we're going to see bubble up that come out of this story, which I don't, you know, I think it's good because it's an issue that needs to be talked about more broadly.

27:32But I will say this investigation has really opened my eyes in terms of, yeah, it's just the number of people, you know, who are active in security rules at some pretty big companies that are doing things that actively assist threat actors in their breaches or provide them a safe, privacy-focused environment for these threat actors to operate. And one of the things I think we'll see from law enforcement as it relates to Team PCP and the fallout from this group is some action in targeting some of those security industry people, which is probably not going to be great news week for those companies.

28:21But I don't know if it's always been the case or if it's just gotten more so over the last few years, but there's just a lot of uncomfortable overlaps between people whose job it is to, you know, make life harder for the threat actors and the threat actors themselves. Yeah, so I'll just leave it at that.

28:47James Wilson: All right, man. Well, let's wrap it up there. We've been chatting back and forth for, it must be months now on this. And so congratulations on being able to publish this work. And of course, folks should head over to KrebsOnSecurity.com to read the entire incredible piece on this. but man, you've piqued my interest now based on what you just said. So stay in touch and I hope I get to talk to you soon. But until then, man, get some sleep. Thanks a lot.