Obfuscated JavaScript or Nothing, (Thu, Apr 9th)
2026-04-12T19:23:50Z•a3959df6edc62f7d0ba0aa7933b8e6258a36d7700543faf205939a91bf1d535e
74c5285cisa-kevcisco-breachcredential-theftgtighoneypot-fingerprintinglow-detectionmalwareobfuscated-javascriptopen-redirectpasswordsphishingrar-archivesha256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788bsource-code-exfiltrationsupply-chainteampcptrivyunc6780virus-totalwebshell
What happened
SANS ISC diaries report multiple notable events: an obfuscated JavaScript file (cbmjlzan.JS, SHA256 a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) was delivered in a phishing RAR archive and shows low detection (≈15 AVs on VirusTotal). A major update on the TeamPCP supply-chain campaign states Cisco source code was stolen via a Trivy-linked breach; Google GTIG tracks TeamPCP as UNC6780 and CISA’s KEV deadline passed without a standalone advisory. Other diaries cover honeypot fingerprinting scans, attacker use of web shells (including poor/default credentials), the prevalence
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- a3959df6edc62f7d0ba0aa7933b8e6258a36d7700543faf205939a91bf1d535e
- Enrichment time
- 2026-04-12T19:23:50Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.