ISC Stormcast For Thursday, April 30th, 2026 https://isc.sans.edu/podcastdetail/9912, (Thu, Apr 30th)
2026-04-30T19:23:53Z•4e7475ce91d9dda9f930e0137f9028fdbd248732fefb92ca3e95662ca36e556f
SANDCLOCKUNC6780applebitwardencanisterSprawlcheckmarx-kicscredential-theftcvehoneypothttp-headersioslibredtailnotification-servicenpm-wormpypireconnaissancesupply-chainteampcpx-vercel-set-bypass-cookiexinference
What happened
SANS ISC diary feed (Apr 23–30, 2026) summarizing multiple operational and security observations: an active TeamPCP supply‑chain campaign update reporting a 26‑day pause ended with three concurrent compromises (Checkmarx KICS, Bitwarden CLI cascade, xinference PyPI), identification of a CanisterSprawl npm worm, credential‑monetization activity tied to UNC6780 (SANDCLOCK), and follow‑on supply‑chain impacts; Apple released iOS/iPadOS fixes for a Notification Services flaw (CVE-2026-28950); several honeypot/recon items including a guest diary on Libredtail, odd web requests, and HTTP traffic saw
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 4e7475ce91d9dda9f930e0137f9028fdbd248732fefb92ca3e95662ca36e556f
- Enrichment time
- 2026-04-30T19:23:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.