isp.sh Dropper Staging and Executing lambsys Go Binary (CVE-2026-33017)

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects common patterns of post-exploitation activity including downloading scripts (isp.sh) via curl/wget, executing shell commands to fetch remote payloads, running suspicious binaries from temporary directories like /var/tmp or /tmp, and persistent execution patterns.