TeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments, (Fri, Apr 3rd)
2026-04-03T19:23:46Z•fbc5f716fc368f593ef094b382f8196cd2b9e4949f241e75b0bb2babb548a6d5
AstraZenecaAxiosCERT-EUCVE-2025-30208DatabricksEuropean CommissionMandiantMercor AISaaS-compromiseSportradarTeamPCPViteapplication-control-bypassattributioncloud-breachdata-exfiltrationexploit-attemptsfileless-malwarepost-compromise-enumerationransomwaresupply-chain
What happened
Update 006 on the TeamPCP supply-chain campaign (intel from Apr 1–3, 2026) confirms a cloud breach impacting the European Commission (CERT‑EU confirmation), reveals additional details on victim Sportradar, and cites Mandiant’s assessment that 1,000+ SaaS environments were affected. This bulletin continues a broader campaign timeline that includes prior confirmed victims (Mercor AI), Databricks and AstraZeneca impacts, dual ransomware operations, post‑compromise cloud enumeration, and evolving attribution (Axios, DPRK references). Separate items note active exploitation attempts against exposed
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- fbc5f716fc368f593ef094b382f8196cd2b9e4949f241e75b0bb2babb548a6d5
- Enrichment time
- 2026-04-03T19:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.