Attempts to Exploit Exposed "Vite" Installs (CVE-2025-30208), (Thu, Apr 2nd)

SANS ISC diary entries (Mar 30–Apr 2, 2026) highlight active exploitation attempts against exposed Vite frontend installs (CVE-2025-30208) and multiple operational developments in the TeamPCP supply‑chain campaign — including the first confirmed victim disclosure, post‑compromise cloud enumeration, dual ransomware operations, ongoing Databricks investigation, and leaked AstraZeneca data. Other notes cover a fileless/malicious script using the registry for persistence, techniques for application‑control bypass enabling data exfiltration, and DShield/Cowrie honeypot telemetry analysis. These are