SANS Stormcast Episode Highlights Cybersecurity Threats Including DNS Anomalies, Phishing, and AI Vulnerabilities

The July 8, 2026, episode of the SANS Internet Storm Center Stormcast covered several cybersecurity topics. A DNS record type 32, labeled 'Nimlock,' was discussed, which historically refers to obsolete protocols—originally NetBIOS name lookups (port 137) and later the Nimrod routing protocol—though modern systems may still generate such traffic. A phishing attack leveraging AnyDesk was detailed, where victims received password-protected executables disguised as PDFs, which then installed a tray minimizer to hide AnyDesk’s remote access activity. Tenda routers and switches were highlighted for containing an unpatched hidden authentication backdoor, allowing admin access via a default password even with invalid credentials. Additionally, the episode warned about vulnerabilities in AI-driven GitHub agents parsing untrusted bug reports, where prompt injection could expose secrets, emphasizing risks in automated issue-response systems. The presenter noted that Macs, rather than Windows systems, were observed generating the obsolete DNS traffic. Detection recommendations included monitoring for unauthorized remote access tools and encrypted executable attachments.