ISC Stormcast For Friday, May 29th, 2026 https://isc.sans.edu/podcastdetail/9950, (Fri, May 29th)
2026-05-30T13:23:47Z•e18ffd07253c0513f0e9481e99f1877643fe4545adf93a8eabe5b99b2241f4bb
akiracredential-stealerdshieldendpoint-logsfirewall-logsforensicsgithub-compromiseisc-podcastkibanamicrosoft-accessphishingpython-sdkransomwaresupply-chainteampcptelemetrytrojanized-packagevba
What happened
SANS ISC diary entries (late May 2026) cover multiple active threats and analytic findings: a detailed supply-chain campaign by 'TeamPCP' that now operates across three package ecosystems, trojanized an officially Microsoft-published Python SDK, reached parts of GitHub’s internal codebase, and published parts of its framework; a reconstruction of an Akira ransomware kill chain emphasizing the need to join perimeter firewall and Windows event logs to answer how intruders moved and gained domain admin; analysis of a year of files uploaded to DShield sensors (with activity peaking Dec 2025–Feb 2
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- e18ffd07253c0513f0e9481e99f1877643fe4545adf93a8eabe5b99b2241f4bb
- Enrichment time
- 2026-05-30T13:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.