Google's Threat Intelligence Group ran a human source inside TeamPCP, the group Google now credits with the worst software supply chain compromise on record, breaching thousands of downstream companies through poisoned packages and build pipelines before the operation surfaced publicly. The infiltration wasn't threat hunting from telemetry. It was a person in the operators' own channels, reading their planning in real time rather than reconstructing it from artifacts after the fact.

The mechanism matters because supply chain compromises are built to be invisible to the companies they hit: a poisoned dependency looks like a routine update until something downstream breaks. TeamPCP's targets didn't detect the intrusion through their own logging. They found out because Google had already been watching the group plan it. That is a different failure mode than a missed patch. It is a visibility gap no scanner closes, because the compromise lives in trust relationships between vendors, not in a single exploitable host.

The same week, ShinyHunters defaced Clop's ransomware leak site and claimed theft of the private keys for Clop's onion service, one extortion crew burning another's infrastructure rather than a defender doing it. Clop built its leak site to extort victims; it didn't build it to survive a rival's intrusion. Neither Clop's operational security nor TeamPCP's operator vetting held, and in both cases the compromise came from inside the network the group trusted, not from outside it.