Google's threat intelligence team had someone on the inside of the hacking group blamed for the biggest software supply chain breach spree ever recorded.
Google's threat intelligence group ran an undercover analyst who worked into the inner circle of TeamPCP, a hacking group blamed for breaching thousands of companies through compromised software supply chains. The infiltration gave Google visibility into the group's operations from the inside, rather than reconstructing them after the fact. TeamPCP's campaign is described as the worst software supply chain hacking spree on record, a superlative that puts it ahead of previous large-scale intrusions built on the same technique. It's not yet clear which industries or products were hit, or how long the undercover operation ran.
Supply chain attacks work because they hide behind trust: one poisoned update can fan out to thousands of downstream customers who never dealt directly with the attacker. Placing a source inside the group beats the usual playbook of forensic cleanup after a breach goes public, and it suggests Google's threat intelligence arm is now doing the kind of human intelligence work normally associated with spy agencies, not software vendors.
SolarWinds showed the world what one compromised update can do. If TeamPCP really tops that record, an inside source may be the only reason anyone knows the full scope at all.