YARA-X 1.18.0 and 1.19.0 Release, (Sun, Jun 28th)
2026-06-28T19:23:48Z•4bad81800344324771cc14a1133e2d3a572982acb609623479c6dddf5b2791f0
CVE-2024-40766IPv4-mapped IPv6Linux process masqueradingT1036Velvet AntYARAYARA-Xconfiguration issuemalware obfuscationphishingsecurity podcastwebshells
What happened
SANS ISC diary entries (June 18–28, 2026) cover a YARA‑X release (1.18.0 and 1.19.0) with improvements and bugfixes; an analysis of Linux process name masquerading (MITRE ATT&CK T1036) used by threat actors (example: Velvet Ant) to hide malicious processes; continued prevalence of webshells including a recently observed GitHub-published variant; an eBanking phishing campaign that leveraged IPv4‑mapped IPv6 addresses targeting a major Belgian bank; and a note about CVE-2024-40766 where the vendor patch addressed the bug but insecure configuration remained unmitigated. Several ISC Stormcast (pod
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 4bad81800344324771cc14a1133e2d3a572982acb609623479c6dddf5b2791f0
- Enrichment time
- 2026-06-28T19:23:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.