Obfuscated JavaScript or Nothing, (Thu, Apr 9th)
2026-04-10T19:23:50Z•6d6498d490611fd44cfbca83a0c76dc97960bd4722e2a7078ba93478ed7f6b00
cisa-kevcisco-breachhoneypot-fingerprintingmalwareobfuscated javascriptopen-redirectphishingrar-archivesha256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788bsupply-chainteampcptrivyunc6780webshell
What happened
Collection of SANS ISC diary entries (April 6–10, 2026). Notable items: an obfuscated JavaScript payload (cbmjlzan.JS, SHA256 a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) was delivered in a phishing RAR and is detected by only ~15 AV engines on VirusTotal; TeamPCP supply-chain campaign update reports Cisco source code stolen via a Trivy-linked breach, with Google GTIG tracking TeamPCP as UNC6780; CISA KEV deadline arrived without a standalone advisory. Additional coverage: web shells and attacker pivoting, honeypot fingerprinting, use of redirects in phishing, and password
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 6d6498d490611fd44cfbca83a0c76dc97960bd4722e2a7078ba93478ed7f6b00
- Enrichment time
- 2026-04-10T19:23:50Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.