Date Author Title

SUPPLY CHAIN ATTACK

2026-04-27Kenneth HartmanTeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises (Checkmarx KICS, Bitwarden CLI Cascade, xinference PyPI), CanisterSprawl npm Worm Identified, and Tier 1 Coverage Returns

SUPPLY

2026-04-27/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises (Checkmarx KICS, Bitwarden CLI Cascade, xinference PyPI), CanisterSprawl npm Worm Identified, and Tier 1 Coverage Returns
2026-04-08/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 007 - Cisco Source Code Stolen via Trivy-Linked Breach, Google GTIG Tracks TeamPCP as UNC6780, and CISA KEV Deadline Arrives with No Standalone Advisory
2026-04-03/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments
2026-04-01/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows
2026-03-30/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Compromise, TeamPCP Runs Dual Ransomware Operations, and AstraZeneca Data Released
2026-03-28/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 003 - Operational Tempo Shift as Campaign Enters Monetization Phase With No New Compromises in 48 Hours
2026-03-27/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 002 - Telnyx PyPI Compromise, Vect Ransomware Mass Affiliate Program, and First Named Victim Claim
2026-03-26/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 001 - Checkmarx Scope Wider Than Reported, CISA KEV Entry, and Detection Tools Available
2023-07-18/a>Johannes UllrichExploit Attempts for "Stagil navigation for Jira Menus & Themes" CVE-2023-26255 and CVE-2023-26256
2019-10-24/a>Johannes UllrichYour Supply Chain Doesn't End At Receiving: How Do You Decommission Network Equipment?

CHAIN

2026-04-27/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises (Checkmarx KICS, Bitwarden CLI Cascade, xinference PyPI), CanisterSprawl npm Worm Identified, and Tier 1 Coverage Returns
2026-04-08/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 007 - Cisco Source Code Stolen via Trivy-Linked Breach, Google GTIG Tracks TeamPCP as UNC6780, and CISA KEV Deadline Arrives with No Standalone Advisory
2026-04-03/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments
2026-04-01/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows
2026-03-30/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Compromise, TeamPCP Runs Dual Ransomware Operations, and AstraZeneca Data Released
2026-03-28/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 003 - Operational Tempo Shift as Campaign Enters Monetization Phase With No New Compromises in 48 Hours
2026-03-27/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 002 - Telnyx PyPI Compromise, Vect Ransomware Mass Affiliate Program, and First Named Victim Claim
2026-03-26/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 001 - Checkmarx Scope Wider Than Reported, CISA KEV Entry, and Detection Tools Available
2024-07-16/a>Jan Kopriva"Reply-chain phishing" with a twist
2023-07-18/a>Johannes UllrichExploit Attempts for "Stagil navigation for Jira Menus & Themes" CVE-2023-26255 and CVE-2023-26256
2022-09-19/a>Russ McReeChainsaw: Hunt, search, and extract event log records
2019-10-24/a>Johannes UllrichYour Supply Chain Doesn't End At Receiving: How Do You Decommission Network Equipment?
2017-06-02/a>Xavier MertensPhishing Campaigns Follow Trends
2016-11-23/a>Tom WebbMapping Attack Methodology to Controls

ATTACK

2026-04-27/a>Kenneth HartmanTeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises (Checkmarx KICS, Bitwarden CLI Cascade, xinference PyPI), CanisterSprawl npm Worm Identified, and Tier 1 Coverage Returns
2025-09-10/a>Guy BruneauDShield SIEM Docker Updates
2024-01-08/a>Jesse La GrewWhat is that User Agent?
2022-08-10/a>Johannes UllrichAnd Here They Come Again: DNS Reflection Attacks
2022-03-26/a>Guy BruneauIs buying Cyber Insurance a Must Now?
2022-02-03/a>Johannes UllrichKeeping Track of Your Attack Surface for Cheap
2021-02-01/a>Rob VandenBrinkTaking a Shot at Reverse Shell Attacks, CNC Phone Home and Data Exfil from Servers
2019-08-25/a>Guy BruneauAre there any Advantages of Buying Cyber Security Insurance?
2019-07-20/a>Guy BruneauRe-evaluating Network Security - It is Increasingly More Complex
2017-09-06/a>Adrien de BeaupreModern Web Application Penetration Testing , Hash Length Extension Attacks
2016-11-02/a>Rob VandenBrinkWhat Does a Pentest Look Like?
2016-06-03/a>Tom ListonMySQL is YourSQL
2015-03-18/a>Daniel WesemannPass the hash!
2015-02-19/a>Daniel WesemannDNS-based DDoS
2014-02-26/a>Russ McReeOngoing NTP Amplification Attacks
2014-02-17/a>Chris MohanNTP reflection attacks continue
2013-12-02/a>Richard PorterReports of higher than normal SSH Attacks
2013-08-19/a>Guy Bruneau Business Risks and Cyber Attacks
2013-07-27/a>Scott FendleyDefending Against Web Server Denial of Service Attacks
2013-07-13/a>Lenny ZeltserDecoy Personas for Safeguarding Online Identity Using Deception
2012-10-05/a>Richard PorterReports of a Distributed Injection Scan
2011-12-28/a>Daniel WesemannHash collisions vulnerability in web servers
2011-12-01/a>Mark HofmanSQL Injection Attack happening ATM
2011-09-28/a>Richard PorterAll Along the ARP Tower!
2011-01-23/a>Richard PorterCrime is still Crime!
2010-12-23/a>Mark HofmanWhite house greeting cards
2010-08-16/a>Raul SilesDDOS: State of the Art
2010-08-15/a>Manuel Humberto Santander PelaezObfuscated SQL Injection attacks
2010-08-13/a>Tom ListonThe Strange Case of Doctor Jekyll and Mr. ED
2010-03-15/a>Adrien de BeaupreSpamassassin Milter Plugin Remote Root Attack
2010-01-29/a>Johannes UllrichAnalyzing isc.sans.org weblogs, part 2, RFI attacks
2009-11-11/a>Rob VandenBrinkLayer 2 Network Protections against Man in the Middle Attacks
2009-08-28/a>Adrien de BeaupreWPA with TKIP done
2009-06-04/a>Raul SilesTargeted e-mail attacks asking to verify wire transfer details
2009-04-20/a>Jason LamDigital Content on TV
2009-04-02/a>Bojan ZdrnjaJavaScript insertion and log deletion attack tools
2009-03-20/a>donald smithStealthier then a MBR rootkit, more powerful then ring 0 control, it’s the soon to be developed SMM root kit.
2009-02-25/a>Swa FrantzenTargeted link diversion attempts
2009-01-30/a>Mark HofmanRequest for info - Scan and webmail
2009-01-18/a>Maarten Van HorenbeeckTargeted social engineering
2008-12-03/a>Andre LudwigNew ISC Poll! Has your organization suffered a DDoS (Distributed Denial of Service) attack in the last year?
2008-07-09/a>Johannes UllrichUnpatched Word Vulnerability
2008-05-26/a>Marcus SachsPredictable Response
2008-03-27/a>Maarten Van HorenbeeckGuarding the guardians: a story of PGP key ring theft