Obfuscated JavaScript or Nothing, (Thu, Apr 9th)
2026-04-11T13:23:49Z•058e303b029504cf981a0aab99c9dd95be1565d0b4574fe0f983225772c733f5
Cisco-breachTeamPCPTrivyUNC6780credential-thefthoneypot-fingerprintingmalwareobfuscated-javascriptopen-redirectpassword-usagephishingrarsource-code-theftsupply-chainvirus-totalwebshell
What happened
SANS ISC diary items (Apr 6–10, 2026) highlight multiple active threats and research: a phishing-delivered RAR contained highly obfuscated JavaScript (cbmjlzan.JS, SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) detected by only ~15 AV engines on VirusTotal; a major TeamPCP supply-chain campaign update reporting Cisco source-code theft via a Trivy-linked breach and tracking of TeamPCP as UNC6780 (Google GTIG); discussion of CISA KEV deadline issues; ongoing reconnaissance/honeypot-fingerprinting activity; analysis of web shells used for persistence (including default/弱
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 058e303b029504cf981a0aab99c9dd95be1565d0b4574fe0f983225772c733f5
- Enrichment time
- 2026-04-11T13:23:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.