REPORT1 SOURCE
YARA-X 1.21.0 Release, (Sat, Oct 3rd)
YARA-X's 1.21.0 release brings 5 improvements and 4 bugfixes.
First reported Oct 03, 2026 14:40 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordÆ / PUBLIC MALWARE INTELLIGENCE
Follow the evidence.
Published file metadata, source observations, indicators, and research history in one bounded catalog.
11Reachable catalog records
1 / 1Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Review source update dates and status
- src_fb6a3ec633d94a60b2Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
11 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE
TTY Logs and the Data it Captures, (Sun, Oct 4th)
For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY logs are sent daily at the end of each day to the DShield SIEM [2] to be correlated with all the data. 
First reported Oct 05, 2026 00:15 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordREPORT1 SOURCE
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files.
First reported Oct 07, 2026 14:59 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordREPORT1 SOURCE
ISC Stormcast For Monday, October 5th, 2026 https://isc.sans.edu/podcastdetail/10122, (Mon, Oct 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 05, 2026 02:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordREPORT1 SOURCE
ISC Stormcast For Tuesday, October 6th, 2026 https://isc.sans.edu/podcastdetail/10124, (Tue, Oct 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 06, 2026 11:45 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordREPORT1 SOURCE
More RMM Tools In the Wild, (Tue, Oct 6th)
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.
First reported Oct 06, 2026 13:16 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordREPORT1 SOURCE
ISC Stormcast For Wednesday, October 7th, 2026 https://isc.sans.edu/podcastdetail/10126, (Wed, Oct 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 07, 2026 02:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordREPORT1 SOURCE
ISC Stormcast For Thursday, October 8th, 2026 https://isc.sans.edu/podcastdetail/10128, (Thu, Oct 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 08, 2026 02:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordREPORT1 SOURCE
ISC Stormcast For Friday, October 2nd, 2026 https://isc.sans.edu/podcastdetail/10120, (Fri, Oct 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
First reported Oct 02, 2026 02:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordREPORT1 SOURCE
User Agent Strings Curiosities, (Sun, Oct 4th)
Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.
First reported Oct 04, 2026 07:58 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://isc.sans.edu
Indicator published by the cited source.
First reported Oct 02, 2026 02:00 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.