TeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows, (Wed, Apr 1st)

SANS ISC diary update consolidating intelligence through 2026-04-01 on the TeamPCP supply-chain campaign (“When the Security Scanner Became the Weapon”). Key developments: first confirmed victim disclosure; documented post-compromise cloud enumeration; Axios reporting narrows attribution; Databricks investigating an alleged compromise; TeamPCP running dual ransomware operations and entering monetization (Vect ransomware affiliate activity noted previously); Telnyx PyPI compromise and AstraZeneca data release among earlier impacts. The campaign leverages a compromised security scanner and open‑