TeamPCP Supply Chain Hackers Charged in Australia

Thu, 27 Aug 2026 21:01:55 +0000

Engineer — Learn: The underlying March 2026 compromise of Trivy, Checkmarx KICS, and LiteLLM should have already triggered audits; this arrest adds no new technical detail, but serves as a reminder to verify those security scanner pipelines were cleaned and dependency provenance checked at the time.
SOC/IR — Learn: An arrest announcement with no new IOCs or TTPs published; useful as campaign context if the March supply chain incident is already in your threat intel library, but yields no new detection or hunt work today.
Leader — Learn: Confirms attribution and partial closure of a supply chain attack on widely-used DevSecOps tooling — a useful case study for board or risk-committee discussions on open-source software supply chain risk and the adequacy of your vendor/tooling provenance controls.

Snowflake Hacker Pleads Guilty; 165 Orgs and 100M Records Exposed

Thu, 06 Aug 2026 13:03:19 +0000

Engineer — Skip
SOC/IR — Learn: The guilty plea closes the loop on a major credential-based cloud breach campaign; review whether your org’s Snowflake tenant MFA and network policies would have detected or blocked the access patterns used in 2024.
Leader — Learn: A high-profile conviction in a breach affecting 100M people and 165 orgs is useful context for board discussions on cloud vendor risk and credential-based attack exposure; no immediate action required unless your org was among those affected.