Obfuscated JavaScript or Nothing, (Thu, Apr 9th)
2026-04-12T13:23:47Z•12b4ab9bd09f620233dfc153ab7fe361a1ffe0575f4d5c6d7e8f9edbcf68ff48
Cisco source code theftRAR archiveUNC6780credential reusegoogle-gtighoneypot fingerprintingmalwareobfuscated javascriptopen-redirectspasswordsphishingsha256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788bsupply chainteamPCPtrivy-linked breachvirus totalwebshells
What happened
Collection of SANS ISC diary entries covering multiple active threats and observations: a malicious, heavily obfuscated JavaScript (SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) delivered via a RAR from a phishing email and detected by only ~15 AV engines on VirusTotal; TeamPCP supply-chain campaign Update 007 reporting Cisco source code exfiltration linked to a Trivy-related breach and tracked by Google GTIG as UNC6780; ongoing discussions of webshell usage (including weak/default credentials), increased honeypot fingerprinting by attackers, analysis of numeric/date
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 12b4ab9bd09f620233dfc153ab7fe361a1ffe0575f4d5c6d7e8f9edbcf68ff48
- Enrichment time
- 2026-04-12T13:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.