Storm⚡️Watch | Cyber Insights | ICS Security Shockers & ISP Hijacks: Post-Hacker Summer Camp Special
Summary: This GreyNoise podcast episode covers a Censys research report on internet-connected industrial control systems and their vulnerabilities, and examines the threat actor StormBamboo, which compromised an internet service provider to conduct DNS poisoning attacks and exploit insecure software update mechanisms. The hosts describe StormBamboo's deployment of malware families including MACMA and POCOSTICK/MGBot and a malicious Chrome extension called RELOADEXT, and close with a roundup of recent additions to CISA's Known Exploited Vulnerabilities catalog.
Bottom line: StormBamboo reached victims by compromising an ISP and poisoning DNS, then exploiting the software update channel itself - the path most organizations trust by default to deliver patches.
Read the original at GreyNoise Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026