ISC Stormcast For Friday, May 29th, 2026 https://isc.sans.edu/podcastdetail/9950, (Fri, May 29th)
2026-05-29T13:23:49Z•10741ecff08f0e931069bcda4711f3dfdc096685633a1dc18b2debd0b280029e
ACR-stealerAkiraDShieldGitHubMicrosoft-AccessPythonTeamPCPVBAcredential-stealerfirewallforensicsmalicious-macroperimeter-logsphishingransomwaresoftware-supply-chainsupply-chaintelemetrythreat-trendstrojanized-sdkweb-impersonationwindows-event-logs
What happened
SANS ISC diary (May 25–29, 2026) highlights several active threats and telemetry findings: detailed Akira ransomware forensic guidance emphasizing correlating perimeter/firewall logs with Windows event logs to reconstruct intrusion and privilege escalation before encryption; TeamPCP supply‑chain campaign activity that now spans three package ecosystems, reportedly trojanized an official Microsoft‑published Python SDK and published its own framework on GitHub; a report of a web page impersonating the Claude AI service delivering a possible credential/ACR stealer; analysis of one year of files上传
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 10741ecff08f0e931069bcda4711f3dfdc096685633a1dc18b2debd0b280029e
- Enrichment time
- 2026-05-29T13:23:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.