Malicious Script That Gets Rid of ADS, (Wed, Apr 1st)

SANS ISC diary (Mar 27–Apr 1, 2026) aggregates multiple security notes: a rapidly evolving TeamPCP supply‑chain campaign (Telnyx PyPI compromise, Databricks investigation, dual ransomware operations including Vect affiliate activity, AstraZeneca data release, first confirmed victim disclosure, and post‑compromise cloud enumeration) plus posts on a malicious “fileless” script using the registry for persistence/ADS removal, application‑control bypass techniques enabling data exfiltration, and DShield/Cowrie honeypot session analysis. The primary operational risk is active supply‑chain compromise