What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th)

SANS ISC diary feed (Jun 17–25, 2026) highlighting multiple active threat topics: Linux process name masquerading (attacker process name spoofing / MITRE ATT&CK T1036) and rootkit evasion techniques; continued prevalence of webshells (new variants observed); targeted eBanking phishing using IPv4-mapped IPv6 addressing; coordinated SSH brute-force activity over recent months; and a note about CVE-2024-40766 where a vendor patch addressed the bug but operator misconfiguration remained a risk. Recommendations: verify process visibility and integrity (inspect /proc, use out-of-band EDR/kernel att&