ISC Stormcast For Thursday, March 26th, 2026 https://isc.sans.edu/podcastdetail/9866, (Thu, Mar 26th)
2026-03-26T07:23:47Z•a18e77e3600da395fc4ce75ebd6c90fbecff3985ac32da76b4afccd4eb460a9e
AI-code-reviewArechClient2EclypsiumGSocketIP-KVMNetSupportRATRemcosSectopSmartApeSGStealCappleapple-patchesbackdoorbashiosipadOSmacosrogue-devicessecurity-updatestool-updatestvOSvisionOSvulnerability-patchwatchOS
What happened
SANS ISC diary (Mar 20–26, 2026) highlights multiple security items: Apple issued broad March 2026 updates covering ~85 vulnerabilities across recent macOS, iOS/iPadOS, and current tvOS/watchOS/visionOS releases (no active exploitation reported). A SmartApeSG campaign is pushing multiple remote-access trojans and stealers (Remcos RAT, NetSupport RAT, StealC, and Sectop/ArechClient2). A malicious Bash script was observed installing a GSocket backdoor (delivery vector unknown). Coverage also calls out IP KVM risks — including rogue KVM devices and recent Eclypsium research on KVM vulnerabilities
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- a18e77e3600da395fc4ce75ebd6c90fbecff3985ac32da76b4afccd4eb460a9e
- Enrichment time
- 2026-03-26T07:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.