Obfuscated JavaScript or Nothing, (Thu, Apr 9th)
2026-04-11T01:23:52Z•f08603e772b725ecd5a9f6021bc3efcc5d4fb3be16a95d476298ed5fbc44e29b
CiscoRAR archiveTeamPCPTrivyUNC6780honeypot-fingerprintinglow-detectionmalicious scriptobfuscated javascriptopen-redirectspassword-trendsphishingsha256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788bsource-code-theftsupply-chainvirusTotalwebshell
What happened
SANS ISC diaries cover multiple active threats: a highly obfuscated JavaScript payload (cbmjlzan.JS, SHA256 a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) was delivered in a phishing RAR and is detected by only ~15 engines on VirusTotal, indicating a low-detection, likely targeted malicious script. A TeamPCP supply‑chain update reports Cisco source code stolen via a Trivy‑linked breach; Google GTIG tracks TeamPCP as UNC6780 and CISA’s KEV deadline passed without a standalone advisory. Additional coverage notes continued webshell use, honeypot fingerprinting techniques, and a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- f08603e772b725ecd5a9f6021bc3efcc5d4fb3be16a95d476298ed5fbc44e29b
- Enrichment time
- 2026-04-11T01:23:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.