SANS ISC Bulletins Archives Page 37 of 458 | Cyberthreat Blog from Fortify24x7

Formbook Delivered Through Multiple Scripts, (Thu, Nov 13th)

by Cyberthreat Blog | Nov 13, 2025 | SANS ISC Bulletins | 0 |

When I’m teachning FOR610[1], I always say to my students that reverse engineering does not only...

SmartApeSG campaign uses ClickFix page to push NetSupport RAT, (Wed, Nov 12th)

by Cyberthreat Blog | Nov 12, 2025 | SANS ISC Bulletins | 0 |

Introduction This diary describes a NetSupport RAT infection I generated in my lab from the...

Microsoft Patch Tuesday for November 2025, (Tue, Nov 11th)

by Cyberthreat Blog | Nov 11, 2025 | SANS ISC Bulletins | 0 |

Today’s Microsoft Patch Tuesday offers fixes for 80 different vulnerabilities. One of the vulnerabilities is already being exploited, and five are rated as critical. Notable Vulnerabilities: %%cve:2025-62215%%: This...

It isn’t always defaults: Scans for 3CX usernames, (Mon, Nov 10th)

by Cyberthreat Blog | Nov 10, 2025 | SANS ISC Bulletins | 0 |

Today, I noticed scans using the username “FTP_3cx” showing up in our logs. 3CX is a well-known maker of business phone system software [1]. My first guess was that this was a default user for one of their systems....

Honeypot: Requests for (Code) Repositories, (Sat, Nov 8th)

by Cyberthreat Blog | Nov 7, 2025 | SANS ISC Bulletins | 0 |

This is just a quick diary entry to report that I saw requests on my honeypot for (code) repositories: /.git/logs/refs/remotes/origin/main /.git/objects/info /.github /.github/dependabot.yml /.github/funding.yml...

Binary Breadcrumbs: Correlating Malware Samples with Honeypot Logs Using PowerShell [Guest Diary], (Wed, Nov 5th)

by Cyberthreat Blog | Nov 5, 2025 | SANS ISC Bulletins | 0 |

[This is a Guest Diary by David Hammond, an ISC intern as part of the SANS.edu BACS program] My...

Updates to Domainname API, (Wed, Nov 5th)

by Cyberthreat Blog | Nov 5, 2025 | SANS ISC Bulletins | 0 |

For several years, we have offered a “new domain” list of recently registered (or, more accurately, recently discovered) domains. This list is offered via our API (https://isc.sans.edu/api). However, the size of the...

Apple Patches Everything, Again, (Tue, Nov 4th)

by Cyberthreat Blog | Nov 4, 2025 | SANS ISC Bulletins | 0 |

Apple released its expected set of operating system upgrades. This is a minor feature upgrade that also includes fixes for 110 different vulnerabilities. As usual for Apple, many of the vulnerabilities affect multiple operating...

XWiki SolrSearch Exploit Attempts (CVE-2025-24893) with link to Chicago Gangs/Rappers, (Mon, Nov 3rd)

by Cyberthreat Blog | Nov 3, 2025 | SANS ISC Bulletins | 0 |

XWiki describes itself as “The Advanced Open-Source Enterprise Wiki” and considers...

Scans for Port 8530/8531 (TCP). Likely related to WSUS Vulnerability CVE-2025-59287, (Sun, Nov 2nd)

by Cyberthreat Blog | Nov 2, 2025 | SANS ISC Bulletins | 0 |

Sensors reporting firewall logs detected a significant increase in scans for port 8530/TCP and...

X-Request-Purpose: Identifying “research” and bug bounty related scans?, (Thu, Oct 30th)

by Cyberthreat Blog | Oct 30, 2025 | SANS ISC Bulletins | 0 |

This week, I noticed some new HTTP request headers that I had not seen before: X-Request-Purpose:...

How to collect memory-only filesystems on Linux systems, (Wed, Oct 29th)

by Cyberthreat Blog | Oct 28, 2025 | SANS ISC Bulletins | 0 |

I’ve been doing Unix/Linux IR and Forensics for a long time. I logged into a Unix system for...

Category: SANS ISC Bulletins