Milesight has released firmware updates to address multiple critical vulnerabilities, including CVE-2026-28747, in its AIOT cameras that could allow remote code execution or device crashes. The vulnerabilities are currently Not Actively Exploited in the wild, but immediate patching is highly recommended due to the critical severity.
Triage: High priority for immediate patching due to critical CVSS score and potential for full system compromise.
Attack Vector: Remote attackers can exploit weak key generation, hard-coded credentials, and OS command injection flaws over the network.
Ease of Exploit: Low complexity, as it involves hard-coded credentials and keys which can be easily leveraged by unauthenticated remote attackers.
Action Plan
Immediate Action: Upgrade to the latest firmware versions of PE/PC/PA available at the vendor's official support page.
Workaround: Minimize network exposure, ensure cameras are not accessible from the public internet, and isolate them behind firewalls or VPNs.
Detection: Monitor network traffic for unauthorized access attempts, unexpected OS commands, or anomalous device reboots indicating a crash.
Relevant professional terms
Remote Code Execution (RCE)
A cyberattack where an attacker can remotely execute malicious commands or code on a target device or system.
Hard-coded Credentials
The practice of embedding passwords or cryptographic keys directly into the source code or firmware, making them easily discoverable and exploitable by attackers.
Intrado has released a critical software update for its 911 Emergency Gateway (EGW) to address a severe path traversal vulnerability (CVE-2026-6074). While currently not actively exploited, successful exploitation could allow unauthenticated attackers to read, modify, or delete critical system files.
Triage: Critical Urgency (Patch immediately to prevent disruption of emergency services)
Attack Vector: A path traversal condition allows an attacker with network access to bypass authentication and access the EGW management interface.
Ease of Exploit: Low complexity; requires network access but no privileges or user interaction.
Action Plan
Immediate Action: Apply the software update released by Intrado on March 2, 2026. Contact Intrado E911 Support to coordinate the patch.
Workaround: Minimize network exposure, isolate control system networks behind firewalls, and ensure the management interface is not accessible from the internet.
Detection: Monitor network traffic for path traversal patterns (e.g., .../...//) targeting the EGW management interface and audit file access logs for unauthorized modifications.
Relevant professional terms
Path Traversal
A vulnerability that allows attackers to access files and directories stored outside the intended web root folder by manipulating file path references.
EGW (Emergency Gateway)
A network component that routes 911 emergency calls and data between telecommunications networks and public safety answering points (PSAPs).
A breach involving the Checkmarx KICS (Keeping Infrastructure as Code Secure) supply chain has exposed sensitive developer secrets, including API keys and cloud credentials embedded in IaC repositories. Attackers leveraged compromised scanner output to harvest credentials at scale.
The Scheme
TTP 1: Supply chain compromise of a widely used IaC security scanner.
TTP 2: Exfiltration of scan results containing plaintext secrets from developer pipelines.
TTP 3: Credential reuse against cloud provider APIs to pivot into production environments.
Campaign Analysis
The incident reinforces that security tooling itself is a high-value target. When scanners ingest source code and configuration, any compromise of the tool turns defensive telemetry into an offensive goldmine - exposing secrets defenders assumed were protected.
Strategic Takeaway
Treat security tooling with the same zero-trust posture as any third-party dependency. Rotate any credentials that may have passed through affected scanners, enforce secret-scanning at the commit layer, and audit CI/CD pipeline permissions to limit blast radius.
Relevant Terms
IaC (Infrastructure as Code): The practice of managing and provisioning infrastructure through machine-readable definition files rather than manual configuration.
Supply Chain Attack: A cyberattack that targets a trusted third-party vendor or component to compromise downstream users of that software or service.
China-aligned APT "GopherWhisper" is targeting government entities using a custom Go-based toolkit. The group abuses legitimate platforms like Slack, Discord, and Microsoft Outlook to mask command-and-control (C2) communications.
Key TTPs
Initial Access: Spearphishing links to compromise legitimate collaboration accounts.
Execution: Deploys custom Go-based backdoors (LaxGopher, RatGopher, BoxOfFriends) via loaders and injectors.
Defense Evasion: Blends C2 traffic with normal enterprise noise using Microsoft Graph API, Slack, and Discord.
Campaign Analysis
GopherWhisper demonstrates an evolution in living-off-the-cloud tactics, turning everyday enterprise tools into covert infrastructure. This approach significantly complicates detection, allowing the group to maintain persistent access across compromised systems.
Targeting & Infrastructure
Target Profile: Government entities, notably in Mongolia, with dozens of other victims globally.
Infrastructure: Relies on private Slack workspaces, Discord servers, Outlook drafts, and file.io rather than traditional attacker-owned servers.
Relevant Terms
Command and Control (C2): The infrastructure attackers use to communicate with and control compromised systems.
Backdoor: A hidden method used to bypass normal authentication and gain unauthorized access to a system.
The Kyber ransomware gang is targeting Windows and VMware ESXi environments with a dual-platform attack. The Windows variant notably implements Kyber1024 post-quantum encryption to protect symmetric keys, aiming to future-proof extortion operations.
Key TTPs
Execution: Dual-platform deployment using Rust for Windows and a specialized ESXi encryptor that enumerates VMs and encrypts datastores.
The adoption of Kyber1024 cryptography highlights a shift toward future-proofing ransomware against emerging decryption capabilities. Despite this advanced key protection, the core impact remains identical, rendering files unrecoverable without the attacker's private key.
Targeting & Infrastructure
Target Profile: Mission-critical virtualization hosts, Windows file servers, and large enterprises (e.g., a US defense contractor).
Infrastructure: Tor-based ransom infrastructure and dedicated data extortion portals.
Relevant Terms
Post-Quantum Encryption: Cryptographic algorithms designed to be secure against the potential threat of quantum computers breaking current encryption standards.
ESXi: An enterprise-class, type-1 hypervisor developed by VMware for deploying and serving virtual computers.
Unit 42 researchers developed Zealot, a multi-agent AI proof-of-concept that successfully executes autonomous, end-to-end offensive operations against cloud infrastructure.
Key Findings
The Zealot system uses a supervisor-agent architecture with 3 specialist agents to autonomously chain reconnaissance, exploitation, and data exfiltration.
The AI successfully exploited Google Cloud Platform (GCP) misconfigurations, including SSRF and overly permissive IAM roles, to exfiltrate data from BigQuery.
The proof-of-concept demonstrated that AI-driven attacks execute at machine speed, unfolding too rapidly for traditional human defenders to intercept.
The Bottom Line
The functional maturity of offensive AI fundamentally shifts the cloud security paradigm. Because cloud environments are inherently API-driven, they provide the perfect structured interface for autonomous agents to navigate and exploit misconfigurations at scale. Organizations must transition from reactive, human-speed defenses to automated, AI-driven detection and response while rigorously enforcing least privilege.
Relevant Terms
SSRF (Server-Side Request Forgery): A vulnerability where an attacker forces a server to make requests to unintended locations, often to access internal metadata.
IAM (Identity and Access Management): A framework of policies and technologies ensuring that the right users and devices have the appropriate access to resources.
The FBI successfully extracted deleted Signal messages from a defendant's iPhone by targeting the device's push notification database. This forensic technique bypassed app-level deletion, exposing sensitive communications.
The Scheme
TTP 1: Physical forensic extraction of the iPhone's internal memory.
TTP 2: Scraping incoming message previews from the iOS push notification database.
TTP 3: Exploiting OS-level data retention to bypass application deletion.
The Players
Threat Actor:Antifa (Alleged)
Facilitators Arrested:Lynette Sharp
The Consequence
Outcome: Guilty verdicts for vandalizing an ICE detention facility.
Strategic Takeaway
System-level data retention can undermine application-level encryption and deletion, highlighting the critical need to disable message previews.
Relevant Terms
Forensic Extraction: The process of retrieving hidden or deleted data from a digital device using specialized tools.
Push Notification: An automated alert sent by an application to a user's device lock screen or notification center.
