Application Control Bypass for Data Exfiltration, (Tue, Mar 31st)
2026-03-31T19:23:47Z•5a22a543d94d52245c092dbdc7d5699489bd9110516ef3ceccff79d4601f15e5
AstraZenecaCowrieDShieldDatabricksLiteLLMPyPI-compromiseTeamPCPTelnyxVect-ransomwareapplication-control-bypassdata-exfiltrationdetectiondual-ransomware-operationshoneypotincident-responseransomwaresupply-chainthreat-intelligence
What happened
Collection of ISC SANS diary entries (Mar 26–31, 2026) covering: (1) risks from application-control bypasses enabling data exfiltration; (2) an evolving TeamPCP supply‑chain campaign with multiple updates — notable events include PyPI compromises (LiteLLM, Telnyx), Vect ransomware affiliation/mass affiliate activity, dual ransomware operations, alleged compromises under investigation at Databricks, and an AstraZeneca data release; (3) DShield/Cowrie honeypot analytics on session behavior; and (4) recurring ISC Stormcast podcast releases. Guidance and detection resources are referenced in the供s
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 5a22a543d94d52245c092dbdc7d5699489bd9110516ef3ceccff79d4601f15e5
- Enrichment time
- 2026-03-31T19:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.