What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th)
2026-06-28T07:23:45Z•8b7ef05329217062fc83096f3b18465acd880dad9bbfcca989644238bfc2e827
CVE-2024-40766T1036credential attacksipv4-mapped-ipv6malware obfuscationphishingprocess masqueradingrootkitssh brute forcethreat intelvelvet antwebshell
What happened
This ISC SANS diary collection (June 17–25, 2026) covers multiple active threats and research observations: Linux process name masquerading (MITRE T1036) and rootkit-style hiding techniques (including activity linked to the Velvet Ant group); continued prevalence and new variants of webshells; a phishing campaign targeting a Belgian bank using IPv4-mapped IPv6 addressing; coordinated SSH brute-force activity over recent months; and a note on CVE-2024-40766 where a vendor patch addressed the bug but insecure configuration remained. Guidance and telemetry-focused analysis are provided across the
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 8b7ef05329217062fc83096f3b18465acd880dad9bbfcca989644238bfc2e827
- Enrichment time
- 2026-06-28T07:23:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.