GSocket Backdoor Delivered Through Bash Script, (Fri, Mar 20th)

SANS ISC diary (Mar 16–20, 2026) reports multiple incidents and telemetry. Key item: a discovered malicious Bash script that installs a GSocket backdoor on a victim Linux host; the script’s origin and delivery vector are unknown. Other entries note honeypot/cowrie findings (an interesting “MAGIC_PAYLOAD_KILLER_HERE…” string, port scans, a successful Telnet login and related web/iptables activity from IP 64.89.161.198), widespread scans for phpMyAdmin/“adminer”, /proxy/ URL scan activity, use of IPv4-mapped IPv6 addresses likely for obfuscation, and regular ISC Stormcast podcast entries. No CVE