ISC Stormcast For Tuesday, September 22nd, 2026 https://isc.sans.edu/podcastdetail/10104, (Tue, Sep 22nd)
2026-09-22T07:23:41Z•1b2e407840aa42964cd2f715fbacdcedb9e73103ede5e6d5ff22c32d3ca8876f
HTTP QUERYLausivLoaderPNG steganographySANS ISCTerminalFixhospitality applicationsmacOS 27malspammalwaremultistage intrusionphishingreverse tunnelsteganographythreat intelligenceweb scanning
What happened
SANS Internet Storm Center RSS entries covering September 15–22, 2026. The most security-relevant items describe the TerminalFix campaign using multistage intrusion techniques, reverse tunneling, and PNG steganography; LausivLoader malware delivery through a targeted malspam attachment; and scanning activity targeting hospitality applications. Other entries discuss the new HTTP QUERY method and macOS 27 first-boot network behavior. No specific CVE identifiers are provided.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 1b2e407840aa42964cd2f715fbacdcedb9e73103ede5e6d5ff22c32d3ca8876f
- Enrichment time
- 2026-09-22T07:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.