ISC Stormcast For Thursday, May 28th, 2026 https://isc.sans.edu/podcastdetail/9948, (Thu, May 28th)
2026-05-28T13:23:47Z•46a3fc301e78821248d65ab6a60991c662a2400bc47ca1e87945c4d6a392a180
ACR stealerAkiraGitHub compromiseMicrosoft AccessPython SDKTeamPCPVBA macrosWindows Event LogWiresharkcredential stealerdigital forensicsfirewall logsincident responsemalware developmentransomwarered teamingsoftware supply chainsupply chaintrainingtrojanized packagesvulnerabilityweb‑based credential theft
What happened
SANS ISC diary roundup (May 23–28, 2026) covering multiple security topics: a forensic-focused write-up reconstructing an Akira ransomware kill chain by correlating perimeter firewall and Windows event logs; a TeamPCP supply-chain campaign that trojanized packages across three ecosystems, reached GitHub internal code, and trojanized an officially Microsoft-published Python SDK; a reported page impersonating Claude hosting a possible ACR stealer; Wireshark 4.6.6 release addressing one vulnerability and multiple bugs; notes on Microsoft Access files containing VBA code and a write-up on stack--
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 46a3fc301e78821248d65ab6a60991c662a2400bc47ca1e87945c4d6a392a180
- Enrichment time
- 2026-05-28T13:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.