TeamPCP Supply Chain Campaign: Update 001 - Checkmarx Scope Wider Than Reported, CISA KEV Entry, and Detection Tools Available, (Thu, Mar 26th)
2026-03-26T19:23:51Z•d456cd67b29b046ca0f530d648106cd1d70951734ba110b531afd890de0fe038
Apple-patchesCISA-KEVCheckmarxGSocket-backdoorIP-KVMLiteLLMNetSupportPyPIRemcosSANS-ISCSectopSmartApeSGStealCTeamPCPdetection-toolssupply-chainthreat-intel
What happened
SANS ISC feed highlights a major update to the TeamPCP supply‑chain campaign report (“When the Security Scanner Became the Weapon” v3.0). The update indicates Checkmarx impact is broader than initially reported, notes the incident (including the March 24 LiteLLM PyPI compromise) has been entered on CISA’s KEV list, and that detection tools and rules have been published to help defenders. Other notable items in the feed: Apple’s March 2026 security updates (85 fixes), a SmartApeSG campaign distributing multiple RATs (Remcos, NetSupport, StealC, Sectop/ArechClient2), discussion of IP KVM risks/“
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- d456cd67b29b046ca0f530d648106cd1d70951734ba110b531afd890de0fe038
- Enrichment time
- 2026-03-26T19:23:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.