News Centre

This is a joint media release between the Australian Federal Police, Federal Bureau of Investigation, and Western Australia Police Force

Editor’s note: Arrest vision available via Hightail 

Two West Australian men have been charged following a joint investigation between the AFP and Western Australia Police Force (WAPF), working in parallel with the Federal Bureau of Investigation (FBI), into a sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses.

The AFP charged the men yesterday (26 August, 2026) with a combined total of 14 offences after executing search warrants in Perth with WAPF, and the assistance of the FBI.

Both men are scheduled to appear in Perth Magistrates Court today (27 August, 2026).

Police will allege the men were part of a highly organised syndicate involved in large-scale cybercrime offending, including data intrusion, identity crime, and cryptocurrency-based money laundering.

Parallel investigations started in April, 2026, after the AFP and FBI received information from multiple cyber threat assessment companies regarding a syndicate that allegedly inserted malicious code into software available on an open-source repository, which was then unwittingly used by other developers.

Police will allege infected software was then distributed into computer systems at other organisations across government, academia and the private sector. The software allegedly enabled the syndicate to infiltrate those organisations to steal or harvest sensitive data, including user credentials and authentication materials.

It is estimated the malicious code potentially compromised more than 1000 organisations globally, enabling the theft of more than 500,000 credentials, and the exfiltration of at least 300 gigabytes of data.

The alleged compromise of a small number of trusted software components had a significant global impact. To date, the financial impact includes global remediation costs estimated to be hundreds of millions of dollars.

Investigators from the AFP, FBI and WAPF allegedly linked the WA men to the syndicate and the AFP and WAPF executed search warrants yesterday (26 August, 2026) at properties in Cottesloe, Hamilton Hill and Mandurah.

The two WA men were arrested, and electronic devices and other items were seized from the properties for forensic analysis.

Police allege the WA men were principal participants in the activities of the cybercrime syndicate and received payments in cryptocurrency for their roles in the illegal activity, the value of which is still under investigation.

A Cottesloe man, 21, was charged with:

• One count of possessed data with the intent to commit a computer offence, contrary to section 478.3(1) of the Criminal Code (Cth). The maximum penalty for this offence is three years’ imprisonment;
• Four counts of unauthorised modification of data with intention to commit a serious offence, contrary to sections 477.1 and 372.1 of the Criminal Code (Cth). The maximum penalty for this offence is five years’ imprisonment;
• One count of supplying data with intent to commit a computer offence, contrary to sub-section 478.4(1) of the Criminal Code (Cth). The maximum penalty for this offence is three years’ imprisonment;
• One count of fail to comply with a 3LA order, contrary to section 3LA of the Crimes Act 1914 (Cth). The maximum penalty for this offence is 10 years’ imprisonment; and
• One count of dealing with proceeds of crime, money or property worth $100,000 or more, contrary to section 400.4(1) of the Criminal Code (Cth). The maximum penalty for this offence is 20 years’ imprisonment;

A Mandurah man, 23, was charged with:

• One count of possessed data with the intent to commit a computer offence, contrary to section 478.3(1) of the Criminal Code (Cth). The maximum penalty for this offence is three years’ imprisonment;
• Four counts of unauthorised modification of data with intention to commit a serious offence, contrary to sections 477.1 and 372.1 of the Criminal Code (Cth). The maximum penalty for this offence is five years’ imprisonment; and
• One count of supplying data with intent to commit a computer offence, contrary to sub-section 478.4(1) of the Criminal Code (Cth). The maximum penalty for this offence is three years’ imprisonment.

A large volume of data seized is being forensically examined and the investigation remains ongoing. Further arrests and charges have not been ruled out.

AFP Commander Graeme Marshall said the AFP remained committed to working with valued partners to identify, disrupt and dismantle criminal syndicates that enabled cybercrime on a global scale.

“Cybercrime knows no borders and is a growing threat globally, so by leveraging connections and sharing advanced policing capabilities with our partners, the AFP amplifies its impact by disrupting cybercriminals across the world,” Commander Marshall said.

“The AFP's greatest force multiplier is its network of trusted law enforcement partners domestically and around the world and strong partnerships turn local intelligence into global action.

"The most effective law enforcement outcomes are achieved when agencies share intelligence, expertise, and resources across borders.

“Cybercrime syndicates are becoming increasingly organised and often operate like professional businesses, but our investigators are relentless in tracking down criminals who attempt to exploit digital anonymity to attack our community.

“In this matter, the information provided to authorities by a number of threat assessment companies proved crucial for investigators.

“The AFP’s partnerships extend to private companies as well and industry bodies are part of the solutions to cybercrime.

“Early reporting and sustained cooperation between organisations and law enforcement play a critical role in supporting cybercrime investigations, protecting affected individuals, and mitigating the broader impact of cybercrime across the Australian community.”

FBI Cyber Division Assistant Director, Brett E. Leatherman, said the arrests demonstrated the FBI’s global reach and strength of its international partnerships.

“These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide,” Assistant Director Leatherman said.

“We are proud to work with the Australian Federal Police and the Western Australia Police Force to impose cost on criminal actors and combat the growing threat of software supply-chain attacks.”

WAPF Acting Commander Peter Foley said that this disruption is a significant event for law enforcement and the Western Australian community.

“It shows the prevalence of cybercrime in our community and that cybercriminals live amongst us,” Acting Commander Foley said.

“The Western Australia Police Force encourages businesses and individuals to report cybercrimes, no matter the size.

“It is important for police to understand what offences are occurring, have the ability to engage and support victims of crime, be provided with the opportunity to seize and analyse digital evidence from virtual crime scenes.

“This allows investigators to identify cybercriminals and cybercrime syndicates, locate and deal with them.

“This joint investigation shows cybercrime knows no boundaries and that state, national and international law enforcement partners will respond in a collaborative and coordinated manner.

“Businesses and individuals and reminded to ensure that they have up to date cyber security measures in place for their computing infrastructure and devices.”

Anyone who believes they are a victim of cybercrime should report it to police using Report Cyber.

If you are concerned your identity has been compromised, contact the national identity and cyber support service IDCARE website.

Further advice is available on the Australian Cyber Security Centre website.

Watch our cybercrime prevention videos and protect yourself from cybercriminals.

What to do if you’re a victim of a scam

• Stop all communication with the scammer.
• Contact your financial institution if you have transferred money or suspect unusual account activity.
• Report it to police using Report Cyber.
• Report suspected scams to ScamWatch to help others avoid similar scams.
• If you were contacted via social media, report it to the social media platform.
• Use strong, unique passphrases on your accounts and enable multi-factor authentication wherever possible.
• If you are concerned your identity has been compromised, contact the national identity and cyber support services, IDCARE.