Publisher
SANS Internet Storm Center
Stories with reporting from SANS Internet Storm Center, ranked by what is gaining ground now. Each story links to the original articles.
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
SANS Internet Storm Center On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files.
ISC Stormcast For Wednesday, October 7th, 2026 https://isc.sans.edu/podcastdetail/10126, (Wed, Oct 7th)
Image: SANS Internet Storm Center More RMM Tools In the Wild, (Tue, Oct 6th)
SANS Internet Storm Center It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.
ISC Stormcast For Tuesday, October 6th, 2026 https://isc.sans.edu/podcastdetail/10124, (Tue, Oct 6th)
ISC Stormcast For Monday, October 5th, 2026 https://isc.sans.edu/podcastdetail/10122, (Mon, Oct 5th)
Image: SANS Internet Storm Center TTY Logs and the Data it Captures, (Sun, Oct 4th)
SANS Internet Storm Center For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY logs are sent daily at the end of each day to the DShield SIEM [2] to be…
Image: SANS Internet Storm Center User Agent Strings Curiosities, (Sun, Oct 4th)
SANS Internet Storm Center Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.
YARA-X 1.21.0 Release, (Sat, Oct 3rd)
ISC Stormcast For Friday, October 2nd, 2026 https://isc.sans.edu/podcastdetail/10120, (Fri, Oct 2nd)
Image: SANS Internet Storm Center ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
SANS Internet Storm Center Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existing applications...
ISC Stormcast For Thursday, October 1st, 2026 https://isc.sans.edu/podcastdetail/10118, (Thu, Oct 1st)
