The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Security/Investigations
Breach intelligence, attack campaigns, and threat reports targeting the Security/Investigations sector.
Explore Other Sectors
Security/Investigations Threat Reports
Johnson Controls IoT Devices Exposed: 2025 Encryption Vulnerabilities in PowerG, IQPanel & IQHub
In December 2025, security researchers at NCC Group identified and responsibly disclosed four cryptographic vulnerabilities (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) impacting Johnson Controls’ PowerG, IQPanel, and IQHub products. The flaws included cleartext transmission of sensitive information, nonce reuse, weak pseudo-random number generation, and inadequate origin validation. Threat actors could exploit these issues to intercept, decrypt, or manipulate encrypted wireless traffic, potentially altering system behavior or disrupting services in commercial facilities globally. Johnson Controls issued advisories and firmware updates, especially urging customers to migrate to IQPanel 4 with firmware 4.6.1 or later. The incident highlights the continued importance of secure-by-design principles in IoT and OT devices, as attacks increasingly pivot toward embedded and building automation systems. Heightened regulatory focus and attacker sophistication underscore the need for proactive vulnerability management and segmenting critical infrastructure networks.
8 months ago
Kill Chain
CISA Warns of Multiple ICS Vulnerabilities in U-Boot, Festo LX, and CCTV Devices (2025)
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released advisories on three newly discovered vulnerabilities affecting critical components in industrial environments: Universal Boot Loader (U-Boot), Festo LX Appliances, and multiple India-based CCTV cameras. These advisories highlight exploitable weaknesses that could allow threat actors to compromise device integrity, execute unauthorized commands, or pivot deeper into industrial networks, potentially disrupting operations or stealing sensitive data. The vulnerabilities impact a broad range of operational technology (OT) deployments and may require urgent patching or mitigation to prevent exploitation. This incident underscores the increasing volume and diversity of attacks targeting industrial control systems and OT environments. As digital transformation deepens, threat actors continue to capitalize on unpatched systems and weak security controls in critical infrastructure, raising the risks for sectors reliant on ICS technology.
8 months ago
Kill Chain
Critical Flaw in India-Based CCTV Cameras Exposes Credentials via Missing Authentication
In December 2025, a critical vulnerability (CVE-2025-13607) was discovered in multiple India-based CCTV camera systems, particularly impacting D-Link's DCS-F5614-L1 model up to version v1.03.038, with other vendors like Sparsh Securitech and Securus CCTV also implicated. The flaw allowed remote attackers to access sensitive camera configuration information and steal account credentials without any authentication, dramatically raising the risk of unauthorized surveillance, data breaches, or lateral movement across commercial facility networks. Security researchers reported this issue to CISA, who validated the high-severity risk with a CVSS v4 score of 9.3. This incident highlights the persistent risk posed by insecure IoT devices in critical sectors. Vulnerabilities in widely deployed camera models remain a prime target for opportunistic attackers and serve as a cautionary signal amidst the global increase in attacks exploiting exposed IoT endpoints.
8 months ago
Kill Chain
iCam365 CCTV Camera Vulnerabilities Expose Video Streams and Configuration Data in 2025
In November 2025, critical vulnerabilities were disclosed affecting iCam365 CCTV camera models P201 and QC021 (versions 43.4.0.0 and prior), allowing unauthorized access to video streams and configuration data via missing authentication controls. CVE-2025-64770 and CVE-2025-62674 enable attackers present on the same network segment to exploit unauthenticated access to ONVIF and RTSP services, potentially exposing sensitive surveillance footage and device configurations across commercial facilities globally. The vulnerabilities were reported by researcher Truong Nguyen Long and published by CISA after vendor non-responsiveness. This exposure highlights the persistent risk of IoT and security camera devices with weak or missing access controls, coinciding with broader trends of exploitation in internet-connected infrastructure. As remote surveillance soars and IoT devices proliferate, such lapses in device security increase the attack surface for organizations across industries.
8 months ago
Kill Chain
CloudEdge Camera Flaw Exposes Millions: MQTT Wildcard and Credentials Risk
In October 2025, security researchers disclosed a critical vulnerability (CVE-2025-11757) affecting CloudEdge IoT cameras and their mobile application. The flaw, caused by improper sanitization of MQTT topic inputs and the use of hard-coded credentials, allowed remote attackers to subscribe to wildcard topics and intercept sensitive messages. This gave unauthorized access to camera feeds and controls globally for any device running the vulnerable CloudEdge App v4.4.2. Neither CloudEdge nor Meari Technologies responded to official disclosure requests, leaving millions of devices worldwide potentially exposed to attack. This incident exemplifies ongoing risks in consumer IoT, highlighting weaknesses in MQTT implementations and credential management. Similar vulnerabilities are increasingly leveraged by attackers to gain unauthorized access, disrupt operations, and compromise privacy, underscoring the pressing need for stronger IoT security regulation and vendor accountability.
8 months ago
Kill Chain
RondoDox Botnet 2025: Mass Exploitation Sheds Light on Multi-Vendor Security Gaps
In October 2025, security researchers uncovered a major campaign involving the RondoDox botnet, which rapidly weaponized over 50 vulnerabilities across more than 30 device vendors. The attack leveraged an "exploit shotgun" approach, targeting a vast range of internet-facing infrastructure including routers, DVRs, NVRs, CCTV systems, and web servers. Threat actors behind RondoDox employed automated scanning and exploitation, compromising vulnerable devices at scale for botnet expansion, distributed denial-of-service (DDoS) attacks, and potential further malicious activity. The operational impact included service degradation, widespread risk of breach propagation, and the exposure of inadequately secured assets across diverse environments. This incident highlights a surging trend in large-scale, opportunistic exploitation—where attackers rapidly integrate newly disclosed vulnerabilities into botnet tools. The scale and automation reflect the growing sophistication of threat actors, amplifying risks for businesses lagging in patch management and segmentation. Regulatory scrutiny is intensifying as such campaigns threaten critical infrastructure and data security.
8 months ago
Kill Chain
RondoDox Botnet Orchestrates Mass n-day IoT Attacks in 2025
In mid-2025, the RondoDox botnet emerged as a powerful threat targeting IoT and network devices by exploiting 56 known (n-day) vulnerabilities across over 30 device types, including routers, NVRs, DVRs, and CCTV systems. The operators, closely monitoring vulnerability disclosures—such as those revealed at Pwn2Own events—rapidly weaponized publicly disclosed exploits, including CVE-2023-1389 and CVE-2024-12856, using a high-volume "exploit shotgun" methodology to maximize infections. With operations observed since June 2025, the campaign affected both end-of-life and actively supported products, resulting in a widespread compromise of infrastructure, particularly among organizations and consumers with unpatched devices. This attack underscores a growing trend of mass exploitation of n-day vulnerabilities in IoT ecosystems, reflecting increasing automation and sophistication among botnet operators. The pace at which attackers operationalize new exploits demands faster patching, improved segmentation, and heightened baseline security practices across networked environments.
8 months ago
Kill Chain
Persistent Exploitation of Hikvision Camera Vulnerabilities (2017–2025): Lessons for IoT Security
Between 2017 and 2025, waves of exploit attempts have targeted Hikvision IP cameras using vulnerabilities such as CVE-2017-7921. Attackers abused easily guessable or default credentials passed via HTTP GET parameters, leveraging weak authentication mechanisms to access sensitive camera endpoints, user configurations, and device data. The entry vector relied on IoT device misconfigurations and insecure design, while brute-force attempts and credential stuffing remain prevalent. This activity has potential to expose live feeds, user data, and create a foothold into internal networks, with implications for privacy, compliance, and physical security. This breach is notable today as attempts to exploit Hikvision and similar IoT cameras continue at scale, highlighting persistent IoT security challenges due to poor credential hygiene, slow patch adoption, and device interface limitations. The incident demonstrates ongoing risk as attackers increasingly automate targeting of legacy and unpatched embedded devices across global networks.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports