ISC Stormcast For Friday, May 29th, 2026 https://isc.sans.edu/podcastdetail/9950, (Fri, May 29th)
2026-05-30T01:23:44Z•06f36249693522a0bf58221afcdb8e265e5a365150066a8d306db0670ebda97a
ACR stealerAkira ransomwareClaude impersonationDShieldGitHub compromiseISC Stormcast podcastKibanaMicrosoft Access VBAPython package trojanTeamPCPVBA macrosWindows event logsfile uploadsforensicspage impersonationperimeter firewall logsransomware kill chainseasonal activitysensor telemetrysoftware supply chainsupply chain compromisetrojanized SDK
What happened
This SANS ISC diary feed (late May 2026) aggregates multiple posts: an Akira ransomware forensic walkthrough that emphasizes correlating perimeter firewall logs with Windows event logs to reconstruct intrusion timelines; analysis of a year of files uploaded to two DShield sensors using Kibana showing a winter peak (Dec 2025–Feb 2026) and decline since March 2026; multiple ISC Stormcast podcast entries; reporting on a possible ACR stealer hosted on a page impersonating the Claude service; guidance on Microsoft Access files containing VBA; and a detailed TeamPCP supply-chain campaign update (as‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 06f36249693522a0bf58221afcdb8e265e5a365150066a8d306db0670ebda97a
- Enrichment time
- 2026-05-30T01:23:44Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.