ISC Stormcast For Wednesday, August 5th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Security Advisories
Official cybersecurity advisories from CISA, NCSC, SANS Internet Storm Center, FBI Cyber, and NIST. Published security notices and urgent alerts for defenders.
Botnet Hunting for Vulnerabilities in Diagnostic Tools
This morning, I noticed specific sources "hunting" for vulnerabilities in URLs that I haven&#;x26;#;39;t noticed before. All of thes
ISC Stormcast For Tuesday, August 4th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Monday, August 3rd, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Atomic MacOS (AMOS) stealer infection
Introduction 
Phishing Campaigns Targeting AI Solutions Providers
Most phishing campaigns rely on the fact that the victim is afraid to loose "something": money, access to information, ... Many brands have been impersonated by
zipdump.py: Metadata Encoding
I was asked for help with a problem similar to the following. 
ISC Stormcast For Friday, July 31st, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Thursday, July 30th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
![Reconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner [Guest Diary]](https://isc.sans.edu/diaryimages/images/Adam_Cann_pic1.png)
Reconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner [Guest Diary]
[This is a Guest Diary by Adam Cann, an ISC intern as part of the SANS.edu BACS program] 
Apple Patches Everything (July 2026)
I am a bit late with this summary, but this week Apple released updates to all its operating systems and Safari. The Safari update, as usual, targets macOS prio
ISC Stormcast For Wednesday, July 29th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
.png)
AutoIT Payload Injector
For a long time, AutoIT[ 1 ] has been pretty common in the malware ecosystem. Threat actors still use it because it's easy to write and powerful.
ISC Stormcast For Tuesday, July 28th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Java Spring Boot "heapdump" scans
Spring Boot exposes the endpoint "/actuator/heapdump" to collect debug information. By default, the endpoint will return a file heapdump.hprof, which includes a
ISC Stormcast For Monday, July 27th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Scans for ESAFENET CDG 3 Document Management System Weak Logins
ESAFENET&#;x26;#;39;s CDG showed up in our data before. The company focused on secure document management and data leakage preventio
ISC Stormcast For Friday, July 24th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
When the "Autonomous Attacker" Is Your Own AI Model
Two disclosures, five days apart, described the same intrusion from opposite ends — 
 one from the victim, one from the party that turned o
ISC Stormcast For Thursday, July 23rd, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Get Deeper Security Advisories Intelligence
The CyberHawk platform goes far beyond news. Scan indicators, track active campaigns, monitor infostealer feeds, and access a complete analyst toolkit — all free to join.
IOC Scanner — 3.6M+ indicators
Live IOC Feed — filterable threat data
Infostealer Intelligence — live cred logs
Live Threat Map — real-time attacks
MISP Threat Feeds — CIRCL, Feodo, more
GitHub Arsenal — security tools library
Security Blog — deep-dive research
Video Courses — training and education
SOPs — SecOps procedures
Analyst Library — references and toolkits