Application Control Bypass for Data Exfiltration, (Tue, Mar 31st)
2026-04-01T01:23:46Z•d13456d21e15d8498bf4c47f8adeb091adb5e14af582a0fc465b036378b408e5
AstraZenecaCISA-KEVCowrieDShieldDatabricksLiteLLMPyPITeamPCPTelnyxVectapplication-control-bypassdata-exfiltrationdetectionhoneypotransomwaresupply-chainsupply-chain-compromise
What happened
SANS ISC diary entries (late March 2026) highlight an active supply-chain campaign attributed to “TeamPCP” that has escalated from code-repository compromises (LiteLLM PyPI and a reported Telnyx PyPI compromise) into monetization via ransomware (Vect partnership, mass affiliate operations and possible dual ransomware activity). Updates note wider scope (Checkmarx), a CISA KEV entry and published detection tools, an alleged Databricks compromise under investigation, and at least one named victim (AstraZeneca) with released data. Separate posts warn about application-control bypass techniques to
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- d13456d21e15d8498bf4c47f8adeb091adb5e14af582a0fc465b036378b408e5
- Enrichment time
- 2026-04-01T01:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.