Tool updates: lots of security and logic fixes, (Mon, Mar 23rd)
2026-03-24T01:23:48Z•246520e07b02d0868ed5a2c398b9d1c2d534842f330bd3d9ec922aae909b0b5a
GSocketSANS-ISCadminerbackdoorbash scriptcowriehoneypotipv4-mapped-ipv6iranbotmalwareobfuscationphpmyadminscanningshell scripttelnetthreat-detection
What happened
SANS ISC diary entries covering multiple detection and toolkit topics: a malicious Bash script that installs a GSocket backdoor (delivery vector unknown); honeypot/cowrie logs showing scanning activity, Telnet compromise and an echoed payload string referencing “iranbot” from source IP 64.89.161.198; widespread scans targeting database management UIs (phpMyAdmin/adminer); and notes on IPv4-mapped IPv6 address usage as an obfuscation/transition tactic. Also includes general tool updates/security fixes and routine Stormcast podcast entries. No specific CVEs are cited in the entries.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 246520e07b02d0868ed5a2c398b9d1c2d534842f330bd3d9ec922aae909b0b5a
- Enrichment time
- 2026-03-24T01:23:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.