Scans for EncystPHP Webshell, (Mon, Apr 13th)
2026-04-13T19:23:53Z•49a7c4c3529e4978d9c98b116a73fe7c83816d28de2bc9f28ec29c20718f0c07
2026-04CISA-KEVCiscoEncystPHPFortinetFreePBXISC-SANSTeamPCPTrivyUNC6780fingerprintinghoneypotmalware-hash:SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e3227776obfuscated-javascriptphishingscanningsource-code-exposuresupply-chainwebshell
What happened
SANS ISC observed active scans for the EncystPHP webshell—commonly used against vulnerable FreePBX systems—with attackers increasingly deploying webshells that use harder-to-guess credentials. The feed also highlights a TeamPCP supply-chain campaign update reporting Cisco source code stolen via a Trivy-linked breach (Google GTIG tracks TeamPCP as UNC6780) and notes the CISA KEV deadline passed without a standalone advisory. Additional observations include phishing-delivered obfuscated JavaScript (cbmjlzan.JS, SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) and ongoing:
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 49a7c4c3529e4978d9c98b116a73fe7c83816d28de2bc9f28ec29c20718f0c07
- Enrichment time
- 2026-04-13T19:23:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.