ISC Stormcast For Thursday, April 23rd, 2026 https://isc.sans.edu/podcastdetail/9904, (Thu, Apr 23rd)

SANS ISC diary entries (Apr 16–23, 2026) covering multiple operational and research items: guest diaries describing Telegram tdata being abused for credential harvesting (from a honeypot incident) and compromised DVR devices found in the wild; a report of threat actors delivering malware via .wav audio files; an incident analysis of Lumma Stealer infections accompanied by the Sectop RAT (ArechClient2); and guidance/discussion on handling the daily CVE flood using EPSS. Several daily “ISC Stormcast” podcast notices were also published during the week.