SANS Stormcast Tuesday, December 2nd, 2025: Analyzing ToolShell from Packdets; Android Update; Long Game Malicious Browser Ext. https://isc.sans.edu/podcastdetail/9720

[Guest Diary] Hunting for SharePoint In-Memory ToolShell Payloads https://isc.sans.edu/diary/32524

SANS Stormcast Monday, December 1st, 2025: More ClickFix; Teams Guest Access; Geoserver XXE Vulnerablity https://isc.sans.edu/podcastdetail/9718

SANS Stormcast Wednesday, November 26th, 2025: Attacks Against Messaging; Passwords in Random Websites; Fluentbit Vuln; #thanksgiving https://isc.sans.edu/podcastdetail/9716

SANS Stormcast Tuesday, November 25th, 2025: URL Mapping and Authentication; SHA1-Hulud; Hacklore https://isc.sans.edu/podcastdetail/9714

Conflicts between URL mapping and URL based access control. https://isc.sans.edu/diary/32518

SANS Stormcast Monday, November 24th, 2025: CSS Padding in Phishing; Oracle Identity Manager Scans Update; https://isc.sans.edu/podcastdetail/9712

YARA-X 1.10.0 Release: Fix Warnings https://isc.sans.edu/diary/32514

Wireshark 4.4.1 Released https://isc.sans.edu/diary/32512

Use of CSS stuffing as an obfuscation technique? https://isc.sans.edu/diary/32510

SANS Stormcast Friday, November 21st, 2025: Oracle Idendity Manager Scans; SonicWall DoS Vuln; Adam Wilson (@sans_edu) reducing prompt injection. https://isc.sans.edu/podcastdetail/9710

Oracle Identity Manager Exploit Observation from September (CVE-2025-61757) https://isc.sans.edu/diary/32506

SANS Stormcast Thursday, November 20th, 2025: Unicode Issues; FortiWeb More Vulns; DLink DIR-878 Vuln; Operation WrtHug and ASUS Routers https://isc.sans.edu/podcastdetail/9708

Unicode: It is more than funny domain names. https://isc.sans.edu/diary/32472

SANS Stormcast Wednesday, November 19th, 2025: Kong Tuke; Cloudflare Outage https://isc.sans.edu/podcastdetail/9706

ISC diary: #KongTuke activity using #CAPTCHA style #ClickFix lure leads to malicious #Python script https://isc.sans.edu/diary/32498

SANS Stormcast Tuesday, November 18th, 2025: Binary Expression Decoding. Tea NPM Pollution; IBM AIX NIMSH Vulnerability https://isc.sans.edu/podcastdetail/9704

Decoding Binary Numeric Expressions https://isc.sans.edu/diary/32490

SANS Stormcast Monday, November 17th, 2025: New(isch) Fortiweb Vulnerability; Finger and ClickFix https://isc.sans.edu/podcastdetail/9702

Finger.exe & ClickFix https://isc.sans.edu/diary/32492

SANS Holiday Hack Challenge 2025 https://isc.sans.edu/diary/32488

Honeypot: FortiWeb CVE-2025-64446 Exploits https://isc.sans.edu/diary/32486

Microsoft Office Russian Dolls https://isc.sans.edu/diary/32484

SANS Stormcast Friday, November 14th, 2025: SmartApeSG and ClickFix; Formbook Obfuscation Tricks; Sudo-rs Vulnerabilities; SANS Holiday Hack Challenge https://isc.sans.edu/podcastdetail/9700

Formbook Delivered Through Multiple Scripts https://isc.sans.edu/diary/32480

SANS Stormcast Thursday, November 13th, 2025: OWASP Top 10 Update; Cisco/Citrix Exploits; Test post quantum readiness https://isc.sans.edu/podcastdetail/9698

ISC diary: #SmartApeSG campaign uses #ClickFix page to push #NetSupportRAT https://isc.sans.edu/diary/32474

SANS Stormcast Wednesday, November 12th, 2025: Microsoft Patch Tuesday; Gladinet Triofox Vulnerability; SAP Patches https://isc.sans.edu/podcastdetail/9696

Microsoft Patch Tuesday for November 2025 https://isc.sans.edu/diary/32468

SANS Stormcast Tuesday, November 11th, 2025: 3CX Related Scans; Watchguard Default Password; https://isc.sans.edu/podcastdetail/9694

It isn't always defaults: Scans for 3CX usernames https://isc.sans.edu/diary/32464

SANS Stormcast Monday, November 10th, 2025: Code Repo Requests; Time Delayed ICS Attacks; Encrypted LLM Traffic Sidechannel Attacks https://isc.sans.edu/podcastdetail/9692

Honeypot: Requests for (Code) Repositories https://isc.sans.edu/diary/32460

SANS Stormcast Friday, November 7th, 2025: PowerShell Log Correlation; RondoBox Disected; Google Chrome and Cisco Patches https://isc.sans.edu/podcastdetail/9690

Binary Breadcrumbs: Correlating Malware Samples with Honeypot Logs Using PowerShell [Guest Diary] https://isc.sans.edu/diary/32454

SANS Stormcast Thursday, November 6th, 2025: Domain API Update; Teams Spoofing; VShell Report https://isc.sans.edu/podcastdetail/9688

Updates to Domainname API https://isc.sans.edu/diary/32452

SANS Stormcast Wednesday, November 5th, 2025: Apple Patches; Exploits against Trucking and Logistic; Google Android Patches https://isc.sans.edu/podcastdetail/9686

Apple Patches Everything, Again https://isc.sans.edu/diary/32448

SANS Stormcast Tuesday, November 4th, 2025: XWiki SolrSearch Exploits and Rapper Feud; AMD Zen 5 RDSEED Bug; More Malicious Open VSX Extensions https://isc.sans.edu/podcastdetail/9684

XWiki SolrSearch Exploit Attempts (CVE-2025-24893) with link to Chicago Gangs/Rappers https://isc.sans.edu/diary/32444

SANS Stormcast Monday, November 3rd, 2025: Port 8530/8531 Scans; BADCANDY Webshells; Open VSX Security Improvements https://isc.sans.edu/podcastdetail/9682

Scans for Port 8530/8531 (TCP). Likely related to WSUS Vulnerability CVE-2025-59287 https://isc.sans.edu/diary/32440

SANS Stormcast Friday, October 31st, 2025: Bug Bounty Headers; Exchange hardening; MOVEIt vulnerability https://isc.sans.edu/podcastdetail/9680

X-Request-Purpose: Identifying "research" and bug bounty related scans? https://isc.sans.edu/diary/32436

SANS Stormcast Thursday, October 30th, 2025: Memory Only Filesystems Forensics; Azure Outage; docker-compose patch https://isc.sans.edu/podcastdetail/9678

How to collect memory-only filesystems on Linux systems https://isc.sans.edu/diary/32432

SANS Stormcast Wednesday, October 29th, 2025: Invisible Subject Character Phishing; Tomcat PUT Vuln; BIND9 Spoofing Vuln PoC https://isc.sans.edu/podcastdetail/9676

A phishing with invisible characters in the subject line https://isc.sans.edu/diary/32428

SANS Stormcast Tuesday, October 28th, 2025: Bytes over DNS; Unifi Access Vuln; OpenAI Atlas Prompt Injection https://isc.sans.edu/podcastdetail/9674