What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th)

Collection of SANS ISC diary items (Jun 17–25, 2026) covering multiple operational threats and defensive observations: Linux process-name masquerading (technique mapped to MITRE ATT&CK T1036, used by groups such as Velvet Ant) and the detection challenges posed by rootkits and process-hiding; continued prevalence and new variants of webshells; an e-banking phishing campaign leveraging IPv4-mapped IPv6 addressing; analysis of coordinated SSH brute-force activity over the prior three months; and a note about CVE-2024-40766 where the software patch fixed the code issue but insecure configuration/