ISC Stormcast For Wednesday, April 8th, 2026 https://isc.sans.edu/podcastdetail/9884, (Wed, Apr 8th)
2026-04-08T07:23:47Z•855bb62cf1daf31d8b77cbe4389a1eaf5fec4d43e83e9c6de53c78fefe2b0457
CERT-EUCVE-2025-30208DPRK-attributionISC-StormcastLiteLLMMandiantMercor AISaaS-compromiseSportradarTeamPCPVitecloud-breachdefault-credentialsexploitationfileless-malwareopen-redirectpersistencephishingregistry-persistencesupply-chainthreat-intelweb-shell
What happened
Collection of SANS ISC diary items (early April 2026) covering several active threats and intelligence updates: continued use of web shells (including poor/backdoor credentials) for persistence and post-exploitation activity; measurement/discussion of open-redirect abuse in phishing campaigns; TeamPCP supply-chain campaign update confirming a European Commission cloud breach (CERT‑EU), disclosures from victims (e.g., Mercor AI), Sportradar-related details, and Mandiant reporting ~1,000+ SaaS environments impacted; active attempts to exploit exposed Vite installations (CVE-2025-30208); and a “fi
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 855bb62cf1daf31d8b77cbe4389a1eaf5fec4d43e83e9c6de53c78fefe2b0457
- Enrichment time
- 2026-04-08T07:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.