TeamPCP Supply Chain Campaign: Update 003 - Operational Tempo Shift as Campaign Enters Monetization Phase With No New Compromises in 48 Hours, (Sat, Mar 28th)

SANS ISC diary batch (Mar 24–28, 2026) focused on the TeamPCP supply‑chain campaign (report: “When the Security Scanner Became the Weapon”, v3.0) and related developments. Key updates (Updates 001–003) document the campaign from initial access (Feb 28) through multiple PyPI compromises (LiteLLM and Telnyx), Checkmarx involvement appearing broader than originally reported, CISA KEV entry for affected packages, and the campaign’s shift into a monetization phase via a Vect ransomware mass‑affiliate partnership and a first named victim claim. As of Update 003 (Mar 28) operators reported no new (s)