Microsoft's Coreutils for Windows, (Thu, Jun 4th)
2026-06-04T07:23:49Z•882e7193cba93542cc3f9722db806dd520c981ac0b0b57c880193d32d5ffa5b2
api-exposurecoreutilsgnuwin32malicious-attachmentsmalspammalwarenetsupportphishingratreconnaissancescanningsoftware-releasesvgswaggeryarayara-x
What happened
SANS ISC diary entries report multiple security-relevant items: a new phishing wave delivering malicious SVG attachments (no visible URLs) used to deliver payloads; an unidentified RAT observed deploying NetSupport RAT to victims; continued automated scans searching for swagger.json (exposed API documentation/attack surface); and a YARA-X 1.17.0 release with performance improvements. A separate note mentions use of GnuWin32/CoreUtils on Windows but no direct vulnerability detail. No specific CVEs were cited in the feed.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 882e7193cba93542cc3f9722db806dd520c981ac0b0b57c880193d32d5ffa5b2
- Enrichment time
- 2026-06-04T07:23:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.