Obfuscated JavaScript or Nothing, (Thu, Apr 9th)
2026-04-11T19:23:51Z•beeb765c2fd9f02e6e1a5d9f219be74e165bf5a30e56b3e391009ea89769d3f1
74c5285CISA-KEVCiscoTeamPCPTrivyUNC6780data-exfiltrationfingerprintinghoneypotjavascriptmalware-sampleobfuscated-javascriptopen-redirectpassword-analyticsphishingrarsha256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788bsource-code-theftsupply-chainthreat-intelvirus-totalwebshell
What happened
SANS ISC diaries covering multiple active threats and research: an obfuscated JavaScript payload (cbmjlzan.JS, SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) delivered in a RAR via phishing and flagged by only ~15 AVs on VirusTotal; an update to the TeamPCP supply-chain campaign (Update 007) reporting Cisco source code theft via a Trivy-linked breach and tracking TeamPCP as UNC6780; and community analyses on honeypot fingerprinting, webshell usage and weak backdoor credentials, abuse of open redirects in phishing, and patterns of numeric use in passwords. These items:
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- beeb765c2fd9f02e6e1a5d9f219be74e165bf5a30e56b3e391009ea89769d3f1
- Enrichment time
- 2026-04-11T19:23:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.