Minacce e avversari · Supply chain

TeamPCP Sovrascrive Tutti i 91 Tag dell'ast-github-action

TeamPCP ha sovrascritto tutti i 91 tag pubblicati dell'ast-github-action di Checkmarx e ha commesso composite action che rubano credenziali prima di invocare l'action legittima. CISA ha aggiunto CVE-2026-33634 al catalogo KEV.

2 fonti · 1 apr

Cronologia

• 9 apr Scadenza federale CISA per CVE-2026-33634
• 1 apr Segnalato da Infosecurity Magazine
• 30 mar Segnalato da SANS ISC

Fonti

• 1 apr Infosecurity Magazine

  TeamPCP Explores Ways to Exploit Stolen Supply Chain Secrets

  TeamPCP is exploring ways to monetize the secrets harvested during supply chain attacks, with identified ties to the Lapsus$ and Vect ransomware gangs

  originale

• 30 mar SANS ISC

  TeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Compromise, TeamPCP Runs Dual Ransomware Operations, and AstraZeneca Data Released

  TeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Compromise, TeamPCP Runs Dual Ransomware Operations, and AstraZeneca Data Released, Author: Kenneth Hartman

  originale

• 28 mar SANS ISC

  TeamPCP Supply Chain Campaign: Update 003 - Operational Tempo Shift as Campaign Enters Monetization Phase With No New Compromises in 48 Hours

  TeamPCP Supply Chain Campaign: Update 003 - Operational Tempo Shift as Campaign Enters Monetization Phase With No New Compromises in 48 Hours, Author: Kenneth Hartman

  originale

Part of the PlainSec briefing for 2026-03-27

Every edition of this story: TeamPCP Sovrascrive Tutti i 91 Tag dell'ast-github-action

Altro da oggi

• TeamPCP Compromette SDK Telnyx su PyPI e Ruba Credenziali