ISC Stormcast For Thursday, April 2nd, 2026 https://isc.sans.edu/podcastdetail/9876, (Thu, Apr 2nd)

SANS ISC diary entries (late Mar–early Apr 2026) highlight an ongoing TeamPCP supply-chain campaign (report v3.0) with multiple updates: confirmed victim disclosure, post-compromise cloud enumeration, narrowed attribution, and monetization via dual ransomware operations. Specific developments include a Databricks investigation, AstraZeneca data release, a Telnyx PyPI compromise and a Vect ransomware partnership. Separate posts describe malicious “fileless” scripts abusing the Windows registry for persistence, application-control bypass techniques used for data exfiltration, and DShield/Cowrie‑