ISC Stormcast For Wednesday, August 5th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Search Intelligence
Botnet Hunting for Vulnerabilities in Diagnostic Tools
This morning, I noticed specific sources "hunting" for vulnerabilities in URLs that I haven&#;x26;#;39;t noticed before. All of these URLs appear to be associated with diag
ISC Stormcast For Tuesday, August 4th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Monday, August 3rd, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Atomic MacOS (AMOS) stealer infection
Introduction 
Phishing Campaigns Targeting AI Solutions Providers
Most phishing campaigns rely on the fact that the victim is afraid to loose "something": money, access to information, ... Many brands have been impersonated by campaigns but I spotted some phishing e
zipdump.py: Metadata Encoding
I was asked for help with a problem similar to the following. 
ISC Stormcast For Friday, July 31st, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
ISC Stormcast For Thursday, July 30th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
![Reconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner [Guest Diary]](https://isc.sans.edu/diaryimages/images/Adam_Cann_pic1.png)
Reconnaissance First: An SSH Bot That Sizes Up Your Hardware Before Deploying a Miner [Guest Diary]
[This is a Guest Diary by Adam Cann, an ISC intern as part of the SANS.edu BACS program] 
Apple Patches Everything (July 2026)
I am a bit late with this summary, but this week Apple released updates to all its operating systems and Safari. The Safari update, as usual, targets macOS prior to macOS 26. macOS updates covered the
ISC Stormcast For Wednesday, July 29th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
.png)
AutoIT Payload Injector
For a long time, AutoIT[ 1 ] has been pretty common in the malware ecosystem. Threat actors still use it because it's easy to write and powerful. Indeed, it can perform all the required
ISC Stormcast For Tuesday, July 28th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Java Spring Boot "heapdump" scans
Spring Boot exposes the endpoint "/actuator/heapdump" to collect debug information. By default, the endpoint will return a file heapdump.hprof, which includes a binary heapdump that can be used to ana
ISC Stormcast For Monday, July 27th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Scans for ESAFENET CDG 3 Document Management System Weak Logins
ESAFENET&#;x26;#;39;s CDG showed up in our data before. The company focused on secure document management and data leakage prevention solutions. The "CDG" stands for "Conte
ISC Stormcast For Friday, July 24th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
When the "Autonomous Attacker" Is Your Own AI Model
Two disclosures, five days apart, described the same intrusion from opposite ends — 
 one from the victim, one from the party that turned out to be responsible —
ISC Stormcast For Thursday, July 23rd, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.