Scanning for AI Models, (Tue, Apr 14th)
2026-04-15T01:23:48Z•1570f8cb69d05ccccef7e1ebcbf14dbdcc3a0c05c58fb37796dc5a4c439eb16d
UNC6780ai-model-scanningcisco-source-code-theftclaudeencystphpfreepbxhoneypot-fingerprintinghuggingfacemalicious-sha256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5microsoft-patch-tuesday-apr-2026obfuscated-javascriptopenclawpassword-researchphishingprobesreconnaissancesupply-chainteampcptrivy-linked-breachwebshell
What happened
SANS ISC diary roundup (Apr 8–15, 2026): Multiple active internet scanning/probing campaigns (started ~Mar 10) looking for AI-model endpoints (claude, openclaw, huggingface, etc.). Ongoing scans for the EncystPHP webshell (noted targeting FreePBX deployments). Phishing-delivered obfuscated JavaScript observed (malicious file SHA256 a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285). TeamPCP supply-chain campaign update: Cisco source code reportedly stolen via a Trivy-linked breach; Google GTIG tracks TeamPCP as UNC6780. Coverage also includes a large Microsoft Patch Tuesday, reh
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 1570f8cb69d05ccccef7e1ebcbf14dbdcc3a0c05c58fb37796dc5a4c439eb16d
- Enrichment time
- 2026-04-15T01:23:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.