GSocket Backdoor Delivered Through Bash Script, (Fri, Mar 20th)

SANS ISC diary entries (Mar 16–20, 2026) report multiple attacker activities. Key item: discovery of a malicious Bash script that installs a GSocket backdoor on a victim Linux host; the delivery vector and origin are unknown. Other reports from honeypots/cowrie and DShield include a notable message string ("MAGIC_PAYLOAD_KILLER_HERE_OR_LEAVE_EMPTY_iranbot_was_here") and activity from IP 64.89.161.198 between 30 Jan–22 Feb 2026 (portscans, successful Telnet login, web access). Additional entries describe widespread scans targeting adminer/phpmyadmin, proxy URL abuse (including use of IPv4-maped