Obfuscated JavaScript or Nothing, (Thu, Apr 9th)
2026-04-10T13:23:51Z•8d3847c26ccb210aca6661830763aa01e5613eeac552dfecf4d18a2c15a53840
CISACiscoGoogle GTIGKEVRARTeamPCPTrivyUNC6780honeypothoneypot fingerprintingmalicious jsobfuscated javascriptopen-redirectpassword-usagephishingsha256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788bsource code theftsupply chainthreat-intelvirus totalwebshell
What happened
Feed of SANS ISC diary posts covering multiple security topics: an obfuscated JavaScript payload (cbmjlzan.JS, SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) delivered in a phishing RAR with low AV detection on VirusTotal; a major TeamPCP supply-chain update reporting a Trivy-linked breach that resulted in Cisco source-code theft, Google GTIG tracking TeamPCP as UNC6780, and notes on the CISA KEV deadline (no standalone advisory); ongoing operational observations including honeypot fingerprinting scans, prevalence and naming of webshells (including weak/default backdo
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 8d3847c26ccb210aca6661830763aa01e5613eeac552dfecf4d18a2c15a53840
- Enrichment time
- 2026-04-10T13:23:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.