‼️ TeamPCP was backing up stolen credentials to a Google Drive account linked to sheepstealing@gmail.com.

Google found a 2019 forum dispute between sheepstealing and a seller of illegal Microsoft Office keys, in which sheepstealing demanded a refund to the PayPal account ruben@thomsonfamily.net.au, which turned out to belong to the recently arrested Ruben Ian Thomson.

Google says that almost from the start, it had a mole inside TeamPCP, the group that laced hundreds of open source packages with malware and breached more than a thousand companies.

Instead of warning each breached company, Google went to AWS, Microsoft and other providers to have the credentials revoked before the hackers could cash them in.

TeamPCP eventually moved servers and cut the persona out of the chat.

Source: https://www.wired.com/story/an-undercover-google-analyst-infiltrated-a-notorious-supply-chain-hacking-gang/