ISC Stormcast For Monday, March 23rd, 2026 https://isc.sans.edu/podcastdetail/9860, (Mon, Mar 23rd)
2026-03-23T13:23:53Z•1495a594749a26809bbfa965e91c5bbab08c1d6c4a7febcd5ce81587048c7ae7
64.89.161.198GSocketadminerbackdoorbash scriptcowriehoneypotiocipv4-mapped-ipv6iranbotmagic_payload_killerphpmyadminproxyscanningtelnet
What happened
SANS ISC diary entries (Mar 16–23, 2026) report multiple attacker activities observed in honeypots: a malicious Bash script that installs a GSocket backdoor (delivery vector not determined); cowrie logs showing successful Telnet login and a distinct string/marker ("MAGIC_PAYLOAD_KILLER_HERE_OR_LEAVE_EMPTY_iranbot_was_here") observed across sensors; scanning activity targeting web database UIs (phpMyAdmin and Adminer); and proxy/URL scanning that includes use of IPv4-mapped IPv6 addresses. An observed source IP (64.89.161.198) is associated with portscans, Telnet compromise, and web access in D
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 1495a594749a26809bbfa965e91c5bbab08c1d6c4a7febcd5ce81587048c7ae7
- Enrichment time
- 2026-03-23T13:23:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.