Brief #148: Telnyx PyPI Supply Chain Attack, F5 BIG-IP RCE Exploited, Databricks Launches Lakewatch SIEM

Happy Sunday,

In this week's analysis:

• Supply chain threat escalation: TeamPCP's multi-ecosystem campaign now includes ransomware partnerships, signaling a shift where open-source infrastructure becomes a first-stage attack vector for extortion.
• CISO leadership deficit: Only 35,000 CISOs serve 359 million businesses globally, a 10,000-to-1 ratio that leaves SMBs structurally exposed.
• Platform disruption: Databricks' Lakewatch SIEM uses consumption pricing to challenge incumbents, and security teams should start evaluating it for 2026 renewal cycles.

TeamPCP Compromises Telnyx PyPI Package, Hides Credential Stealer Inside WAV Audio Files

• TeamPCP pushed two malicious versions (4.87.1 and 4.87.2) of the popular Telnyx Python SDK to PyPI on March 27, embedding credential-stealing malware inside .WAV audio files using steganography to evade detection.
• The attack is part of a broader supply chain campaign that already hit Trivy, KICS, and litellm, and the group has announced partnerships with LAPSUS$ and ransomware group Vect to scale credential abuse before victims complete remediation.
• Pin all GitHub Actions and PyPI dependencies to exact commit SHAs, audit environments for telnyx 4.87.1/4.87.2, rotate all secrets if found, and block the C2 IP (83[.]142[.]209[.]203).

CISA Adds F5 BIG-IP APM Critical RCE Flaw to KEV Catalog After Active Exploitation

• CISA added CVE-2025-53521 (CVSS 9.3) to its Known Exploited Vulnerabilities catalog on March 28 after F5 confirmed active exploitation of a remote code execution flaw in BIG-IP Access Policy Manager that was originally classified as denial-of-service.
• The reclassification from DoS to RCE based on new March 2026 intelligence means organizations that deprioritized the original advisory now face significantly higher risk than initially assessed.
• Verify all BIG-IP APM instances are patched immediately, review network logs for anomalous traffic to virtual servers with APM policies, and treat this as a priority-one patch cycle.

European Commission Investigating Breach After Hackers Access AWS Cloud Infrastructure

• The European Commission confirmed on March 27 that threat actors infiltrated its networks and accessed its AWS cloud infrastructure, with some data confirmed stolen during the breach.
• The incident raises questions about sovereign cloud strategies and third-party cloud dependency across EU institutions, especially as Europe pushes to reduce reliance on US tech infrastructure.
• Review cloud provider access controls and logging configurations, ensure incident response plans cover cloud-native breach scenarios, and monitor for follow-up campaigns targeting exposed data.