ISC Stormcast For Thursday, April 2nd, 2026 https://isc.sans.edu/podcastdetail/9876, (Thu, Apr 2nd)

SANS ISC diary entries (Mar 28–Apr 2, 2026) highlight an active TeamPCP supply‑chain campaign (‘When the Security Scanner Became the Weapon’) with multiple updates: confirmed victim disclosure, documented post‑compromise cloud enumeration, narrowing attribution (Axios reporting), dual ransomware operations, Databricks investigation, and an AstraZeneca data release. Other notes cover tradecraft and detection: a malicious ‘fileless’ script using the registry for persistence and ad‑removal behavior, techniques for application control bypasses enabling data exfiltration, and DShield/Cowrie honeyp0