What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th)

This SANS ISC diary collection (mid‑June 2026) highlights several active threats and research notes: Linux process name masquerading (MITRE T1036) — including real-world use by the Velvet Ant group — as a malware obfuscation technique; continued prevalence and a newly observed webshell (recently pushed to GitHub); an eBanking phishing campaign employing IPv4‑mapped IPv6 addresses targeting a major Belgian bank; analysis of coordinated SSH brute‑force activity over the prior three months; and a discussion of CVE‑2024‑40766 where the vendor patch addressed the bug but insecure configuration left