Security News

Add Punycode to your Threat Hunting Routine, (Tue, Jan 20th)

IDNs or “International Domain Names” have been with us for a while now (see RFC3490[1]). They are (ab)used in many attack scenarios because.. it works! Who can immediately spot the difference between:

ISC Stormcast For Tuesday, January 20th, 2026 https://isc.sans.edu/podcastdetail/9772, (Tue, Jan 20th)

"How many states are there in the United States?", (Sun, Jan 18th)

I&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;ve seen many API requests for different LLMs in the honeypot logs.

Wireshark 4.6.3 Released, (Sat, Jan 17th)

Wireshark release 4.6.3 fixes 4 vulnerabilities and 9 bugs.

ISC Stormcast For Friday, January 16th, 2026 https://isc.sans.edu/podcastdetail/9770, (Fri, Jan 16th)

Battling Cryptojacking, Botnets, and IABs [Guest Diary], (Thu, Jan 15th)

[This is a Guest Diary by Matthew Presnal, an ISC intern as part of the SANS.edu BACS program]

ISC Stormcast For Thursday, January 15th, 2026 https://isc.sans.edu/podcastdetail/9768, (Thu, Jan 15th)

Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)

Introduction

ISC Stormcast For Wednesday, January 14th, 2026 https://isc.sans.edu/podcastdetail/9766, (Wed, Jan 14th)

January 2026 Microsoft Patch Tuesday Summary, (Tue, Jan 13th)

Today, Microsoft released patches for 113 vulnerabilities. One of these vulnerabilities affected the Edge browser and was patched upstream by Chromium.

ISC Stormcast For Tuesday, January 13th, 2026 https://isc.sans.edu/podcastdetail/9764, (Tue, Jan 13th)

ISC Stormcast For Monday, January 12th, 2026 https://isc.sans.edu/podcastdetail/9762, (Mon, Jan 12th)

YARA-X 1.11.0 Release: Hash Function Warnings, (Sun, Jan 11th)

YARA-X&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s 1.11.0 release brings a new feature: hash function warnings.

Malicious Process Environment Block Manipulation, (Fri, Jan 9th)

Reverse engineers must have a good understanding of the environment where malware are executed (read: the operating system). In a previous diary, I talked about malicious code that could be executed when loading a DLL[1]. Today, I&#x27ll show you how a malware can hide suspicious information related to created processes.

ISC Stormcast For Friday, January 9th, 2026 https://isc.sans.edu/podcastdetail/9760, (Fri, Jan 9th)

ISC Stormcast For Thursday, January 8th, 2026 https://isc.sans.edu/podcastdetail/9758, (Thu, Jan 8th)

Analysis using Gephi with DShield Sensor Data, (Wed, Jan 7th)

I&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;m always looking for new ways of manipulating the data captured by my DShield sensor [1]. This time I used Gephi [2] and Graphiz [3] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file. I queried the past 30 days of data stored in my ELK [4] database in Kibana using ES|QL [5][6] to query and export the data and import the result into Gephi. 

A phishing campaign with QR codes rendered using an HTML table, (Wed, Jan 7th)

Malicious use of QR codes has long been ubiquitous, both in the real world as well as in electronic communication. This is hardly surprising given that a scan of a QR code can lead one to a phishing page as easily as clicking a link in an e-mail.

ISC Stormcast For Wednesday, January 7th, 2026 https://isc.sans.edu/podcastdetail/9756, (Wed, Jan 7th)

Tool Review: Tailsnitch, (Tue, Jan 6th)

In yesterday&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s podcast, I mentioned "tailsnitch", a new tool to audit Tailscale configurations. Tailscale is an easy-to-use overlay to Wireguard. It is probably best compared to STUN servers in VoIP in that it allows devices behind NAT to connect directly to each other. Tailscale just helps negotiate the setup, and once the connection is established, data will flow directly between the connected devices. I personally use it to provide remote assistance to family members, and it has worked great for this purpose. Tailscale uses a "Freemium" model. For my use case, I do not need to pay, but if you have multiple users or a large number of devices, you may need to pay a monthly fee. There are also a few features that are only available to paid accounts.