Continuing Scans for swagger.json, (Wed, Jun 3rd)
2026-06-03T19:23:45Z•488dab8d7685174241789bbda8622a9fba217e492addc2e6687ee5d53e794485
api-scanningdshieldinternet-scansmalwarenetsupportphishingratreconnaissanceremote-access-trojansvgswagger.jsontelemetrytoolingtrend-analysisyara-x
What happened
SANS ISC diary roundup (late May–early June 2026) noting multiple active threats and telemetry updates: a new phishing wave delivering malicious SVG files (no embedded URLs, image-only delivery); ongoing internet-wide scans probing for swagger.json (reconnaissance for exposed APIs/documentation); an unidentified RAT observed deploying NetSupport RAT to targets; tooling news (YARA-X 1.17.0 release with performance improvements); and a DShield year-long analysis showing upload activity peaked Dec 2025–Feb 2026 and declined from March 2026. These items indicate active phishing/malware campaigns,猎
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 488dab8d7685174241789bbda8622a9fba217e492addc2e6687ee5d53e794485
- Enrichment time
- 2026-06-03T19:23:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.