Monday’s ISC Stormcast for October 12, 2026 is Johannes Ullrich’s daily shift report from the SANS Internet Storm Center, compiled from DShield sensors and the firewall logs operators already submit. Episode 10132 sits in a long series of briefs where overnight traffic is still dominated by credential guessing against SSH and a short list of other admin listeners, with the same class of rented hosting addresses coming back for another pass. That briefing is cybersecurity intelligence with your fingerprints on it. DShield is a cooperative feed, and your own deny entries help build the chart. The operational miss is leaving those repeat sources able to reach port 22 when the next shift starts.

Stormcast Handed Over Repeat Sources at Shift Change

Stormcast runs like a watch turnover, not a keynote. Handlers spend a few minutes on scanning campaigns, exploit spikes, and the brute-force background that never left sshd. You already know the shape. Port 22. Port 3389. A rotating pile of cloud VPS addresses. Dictionary usernames you should have deleted in 2014. If your edge still terminates SSH on a public IP, you are in that dataset. If Remote Desktop is reachable from the default route, you showed up twice.

Repeat sources are the object worth writing down. Hit counts make a dashboard look alive. The prefixes that return against the same ports, on the same cadence, with the same tools, are a working block list with extra steps. Your threat detection platform folds them into one noisy signature somebody muted years ago. A threat-protection policy that actually protects treats those talkers as drop candidates before they earn a successful logon.

Silenced failure alerts are how guessed passwords become sessions. SSH auth-fail volume is ugly, so teams cap it, then enjoy a quiet queue. Attackers budget for that quiet. They spray from a botnet that changes every host, then land one valid login from a cleaner ASN your analysts have never seen. Plenty of cyber security programs fund detections while sshd still accepts passwords from the world because someone once called the listener internal enough.

ISC’s public DShield views have shown this mix for years: 22/tcp, 23/tcp, 445/tcp, 3389/tcp, plus whatever VPN or panel is trendy that month. Stormcast is the audio version of a report your firewall already wrote. Put a ticket on the named sources and the named ports. Awareness that never becomes an ACL change is a podcast habit, and a poor one for a SOC that claims it hunts.

Cybersecurity Control Gap: Auth Failures With No Source Ban

Your firewall did the honest work. It logged the SYN, the reject, or the handshake that reached sshd. Defense in depth is supposed to start at that log line. The next control is frequently missing. No automatic source ban. No connection-rate policy. No page when a username fails 400 times and then succeeds. That gap is a standing allow you never meant to approve.

Host-level ipban controls exist because perimeter denies leak. Cloud security groups get a hole cut for a vendor. A new subnet appears after a failover. Someone publishes a temporary 22/tcp rule and forgets it. The box still needs to drop a source that just failed auth ten times. On Linux that is fail2ban, sshguard, or sshd’s own PerSourcePenalties and MaxStartups. On Windows, account lockout plus a failure-to-block service does the same job; IPBan Pro is one way to package that loop if you do not already have it. Pick a mechanism you can dump and audit. The brand on the binary is secondary.

You do not need a model to see brute-force. You need a threshold, a ban timer, and an ACL you can produce on request. If your SOC can recite a control narrative and cannot show yesterday’s live deny list for Stormcast talkers, you are collecting souvenirs. Geo and ASN blocks are blunt. They still beat any/any to an admin port. If the business demands SSH from the internet, terminate it on a jump host that only accepts your identity provider. The listener on the workload is attack surface you chose to keep.

Rate limits without identity still matter. sshd will burn CPU on cryptographic handshakes long before a password matches. Connection throttling at the firewall and MaxStartups on the daemon keep the box useful for the people who are supposed to log in. Leave those knobs at defaults and a modest botnet becomes a self-inflicted outage you will file as weird latency on a Monday.

Convert DShield Talkers Into Host Controls Today

Do this on the hosts and edges that still have public admin listeners. Number the sockets. Name the owners. Then cut paths you cannot defend.

Immediate actions for this week’s security hardening:

• Inventory every internet-reachable SSH, RDP, SMB, WinRM, database, and VPN admin port. If you cannot name an owner in ten minutes, shut the path.
• Disable password authentication on SSH; keys or certificates only. Set PermitRootLogin no. Put RDP behind a broker or VPN, never 3389/tcp from 0.0.0.0/0.
• Turn on failure-to-drop: fail2ban, ipban, lockout policy, or cloud auto-block. Start around 5 to 10 failures in 10 minutes, ban for an hour, and ship every ban to the SIEM.
• Pull DShield persistent sources plus your own 7-day top talkers and load them as an explicit deny on the edge. Review false positives once.
• Alert on a successful logon from a source with prior failures, a new ASN, or a country your staff does not work from.

Keep a slower loop so this survives the week you are busy. Reconcile Stormcast and DShield highlighted ports against your exposed inventory after the Monday brief. Rotate remaining passwords on internet-adjacent admin services monthly, and delete unused local accounts in the same change window. Once a quarter, tabletop the failure-storm-then-valid-logon path. Your incident response playbook should open at identity and source IP, not at the ransom note. Defense in depth for guessed credentials is deliberately dull: edge deny, host ban, no passwords on the wire, MFA on the jump host, and a detection that fires on success after failure. Credential-guess intrusions that make the news skipped most of those controls. Your auditors will find that gap in a running sshd_config and an empty ban list, not in a policy PDF.

Incident Response Starts at the Successful Guess

When brute-force works, the rest of the intrusion is housekeeping. The operator has a real account. Your EDR may spawn an alert. It may sleep through a logon that looks like a traveling admin. Credentialed access from a source you meant to drop is still a valid Kerberos ticket or SSH session, and it will pass a lot of “anomalous process” logic because the process is cmd.exe or bash.

You want three artifacts in the first fifteen minutes. Authentication logs with source IP, username, success or fail, and key fingerprint or NTLM/Kerberos detail. Ban and allow history so you can see whether that source was supposed to be dead. Downstream activity for the next half hour: sudo, RDP lateral, mailbox, cloud API. If those three are a scavenger hunt across disconnected vendors, practice the assembly now, during a tabletop, while nobody is paging you.

Hunt before someone else names the tenant. Accounts with a failure storm followed by a success. sshd sessions from ASNs that only appear in deny logs. RDP from hosting providers your staff does not use. New local users created within an hour of a successful guess. That hunt is cheaper than reconstructing a week of untrusted sessions after the fact. Monday’s Stormcast will be back next week with a new date stamp and a familiar port list. Take the names. Ban them. Close the listeners you cannot justify. The ACL change is the part that counts.

Sources

• ISC Stormcast For Monday, October 12th, 2026