TeamPCP Supply Chain Campaign: Update 001 - Checkmarx Scope Wider Than Reported, CISA KEV Entry, and Detection Tools Available, (Thu, Mar 26th)
2026-03-27T01:23:48Z•248bf03748d4d9a7eef44e23824cdf4bfdde4651cfbd9d4acbb6551e610ecb4c
Apple-patchesCISA-KEVCheckmarxGSocketIP-KVMLiteLLMNetSupportPyPIRATSectop-RATStealCTeamPCPbackdoorbash-scriptdetection-toolsiOSmacOSremcosrogue-hardwaresupply-chainsupply-chain-compromisethreat-intelvulnerabilities
What happened
SANS ISC diary roundup (Mar 20–26, 2026): Primary focus is an update to the TeamPCP supply‑chain campaign report (“When the Security Scanner Became the Weapon” v3.0) covering initial access on Feb 28 through the Mar 24 LiteLLM PyPI compromise. New findings indicate Checkmarx’s scope of compromise is broader than originally reported, CISA added a KEV entry related to the campaign, and detection/mitigation tools and indicators have been published. Additional notable items: Apple released March 2026 security updates addressing ~85 vulnerabilities (no in‑the‑wild exploitation reported); SmartApeSG
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 248bf03748d4d9a7eef44e23824cdf4bfdde4651cfbd9d4acbb6551e610ecb4c
- Enrichment time
- 2026-03-27T01:23:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.