A Little Bit Pivoting: What Web Shells are Attackers Looking for?, (Tue, Apr 7th)
2026-04-08T01:23:45Z•5f8aa366a9e8e7daf4668e9b90bf3182c942f3eb50697b6f9ebee9bee6454928
CERT-EUCVE-2025-30208European CommissionMandiantSaaS compromiseSportradarTeamPCPVitearbitrary file writecloud breachdefault credentialsfileless malwareopen redirectpersistencephishingregistry persistenceremote code executionsupply chain compromiseweb shells
What happened
Collection of SANS ISC diary entries (early April 2026) covering: widespread use of web shells for persistence on compromised web servers (including weak/default backdoor credentials and use after arbitrary file-write/RCE vulnerabilities); measurement and abuse of open redirects in phishing; the TeamPCP supply-chain campaign updates (CERT-EU confirming a European Commission cloud breach, Sportradar disclosures, Mandiant estimating >1,000 SaaS environments impacted); observed attempts to exploit exposed Vite installs (CVE-2025-30208); and discussion of fileless/malicious scripts using the OS/UE
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 5f8aa366a9e8e7daf4668e9b90bf3182c942f3eb50697b6f9ebee9bee6454928
- Enrichment time
- 2026-04-08T01:23:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.