Google Says It Watched a Supply-Chain Hacking Gang From the Inside
Google's Threat Intelligence Group says it had a researcher inside TeamPCP during the gang's supply-chain hacking campaign. Ars Technica reports that the group tainted hundreds of open-source programs with malware and stole developer accounts to keep that pipeline going. At a key moment, the undercover researcher let Google watch the spree from the inside, warn the companies being breached, and interfere with TeamPCP's attempts to exploit them. The account comes from the company that ran the operation, which is worth weighing when the operation is described as a clean success.
AI-generated discussion · Different perspectives
This is Google's own account of an operation Google ran, published by the company that collected the intelligence. That doesn't make it false, but it does mean the framing and the timing are chosen by an interested party.
Even granting the self-interest, using that position to warn the targets while the campaign is still running is a different act from publishing a post-mortem later. The value is in the warning, not the write-up.