Hello and welcome to the Tuesday, October 21st, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu graduate certificate program in

cyber defense operations. In diaries today, we have Xavier talk about Python malware. Well, that's

of course Xavier's thing. And this time, Xavier ran into interesting Python malware that uses

Cisco. Syscall, of course, can be used to call. Saville ran into interesting Python malware that uses SisCall.

Sis call, of course, can be used to call operating system functions.

In this particular case, it calls a function that will create a file handle in memory,

allowing for the malware itself to write then into memory, creating fileless

matter. Now, the malver itself is not really that remarkable, as Sadi points out, it appears

to be more of a proof of concept. It implements sort of some pseudo-ransomware in the sense that

it encrypts files with a one-byte x or key, so something that would be

rather easy to prude-force and then to decrypt, which probably could, of course, then

after they sort of got that file as part working right be replaced with a more sophisticated

encryption feature. This particular malware is

somewhat recognized by various scanners according to a virus total, but still not a great

sort of detection rate here, even though that call to Cisco should be somewhat suspicious the way it's being used here.

And of course, the big news today was another outage at AWS, apparently affecting the U.S. East

one region, which usually tends to be one of those crucial regions if it fails.

Well, many other things fail as well.

There are a number of different sites and services that were affected by this outage.

And if you had problems going to any number of different websites or using services and the like, you probably ran into some

...