milesight

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. Here are this week’s stories: Microsoft announces updates to key security offerings Microsoft announced that its SIEM and SOAR solution Sentinel has evolved into a unified AI-ready platform that connects users, agents, devices, actions, and risks across the security environment. This enables defenders to trace attack paths, assess blast radius, and prioritize responses with greater clarity. Security Copilot builds on this foundation, allowing teams to create custom AI agents (no coding required) that integrate seamlessly into daily workflows. With built-in guardrails, companies can scale agents confidently, knowing their digital labor is backed by enterprise-grade security. In addition, the launch of the new Microsoft Security Store simplifies the discovery and deployment of agents and solutions and allows customers to leverage Microsoft’s ecosystem of security partners to implement new agents. BBC journalist offered money in a plot to create an insider threat A BBC journalist was offered a significant amount of money by cybercriminals who sought to hack into BBC’s network in hopes of stealing valuable data and leveraging it for a ransom. The journalist engaged with the hacker for several days to gather information. The hackers seemed skilled and the BBC’s security team decided to temporarily disconnect him completely from the organization’s network as a precaution. FEMA and CBP data stolen via Citrix exploitation A Citrix product vulnerability dubbed CitrixBleed 2 is believed to have been exploited in an attack that resulted in employee data being stolen from the Federal Emergency Management Agency (FEMA) and Customs and Border Protection (CBP), Nextgov reported. The incident may have led to FEMA technology staff being fired over their handling of the situation. LinkedIn user data will train AI LinkedIn users who do not want their data to be used for AI training have one month to take action. LinkedIn will start sharing profile data, job-related data, and content with Microsoft and its affiliates for AI training on November 3. The data collection will be enabled by default, but users can opt out by going to Settings → Data privacy → Data for Generative AI improvement. There is also a form where users can object to the processing of their data for AI training. Android users in UAE targeted with new spyware ESET has analyzed two new spyware families targeting Android users in the United Arab Emirates. The malware, named ProSpy and ToSpy, is disguised as the Signal and ToTok apps. The malicious applications are not distributed through official app stores and they require manual installation. One of the websites distributing ToSpy mimicked the Samsung Galaxy Store. Both spyware families continually exfiltrate sensitive data and files from Android devices. Tile tracker vulnerabilities Researchers have analyzed the location-tracking protocol of Tile trackers. They identified several critical vulnerabilities and design flaws that contradict the company’s security and privacy claims. Their findings indicate that Tile’s servers can permanently track the location of all tags, unprivileged adversaries can track users through Bluetooth, and the anti-theft features are easily compromised. Milesight industrial cellular routers abused for phishing Sekoia has warned that Milesight industrial cellular routers, which are known to have been targeted by threat actors, are being abused for an SMS phishing campaign targeting users in Belgium and elsewhere. An analysis found that 18,000 routers are accessible on the internet, and at least 572 are potentially vulnerable to attacks. Google guidance for protecting against attacks of Salesforce hackers Google Cloud has released proactive hardening recommendations that can aid organizations in protecting their systems against attacks conducted by UNC6040, the threat actor behind the recent Salesforce data theft and extortion campaign, which has impacted several major organizations. Post-quantum cryptography adoption Post-quantum cryptography (PQC) support for SSH servers has increased to 8.5% of all SSH servers and 26% of OpenSSH servers. However, the adoption of TLS 1.3, which supports PQC, has remained at 19%, according to an analysis by Forescout. IoT, OT, IoMT and network devices have a much lower adoption of PQC for SSH than traditional IT devices. In terms of PQC adoption across industries, professional and business services have the highest adoption rates, while manufacturing, oil and gas, and mining account for the lowest adoption.

Unknown threat actors are abusing Milesight industrial cellular routers to send SMS messages as part of a smishing campaign targeting users in European countries since at least February 2022. French cybersecurity company SEKOIA said the attackers are exploiting the cellular router's API to send malicious SMS messages containing phishing URLs, with the campaigns primarily targeting Sweden, Italy, and Belgium using typosquatted URLs that impersonate government platforms like CSAM and eBox, as well as banking, postal, and telecom providers. Of the 18,000 routers of this type accessible on the public internet, no less than 572 are assessed to be potentially vulnerable due to them exposing the inbox/outbox APIs. About half of the identified vulnerable routers are located in Europe. "Moreover, the API enables retrieval of both incoming and outgoing SMS messages, which indicates that the vulnerability has been actively exploited to disseminate malicious SMS campaigns since at least February 2022," the company said. "There is no evidence of any attempt to install backdoors or exploit other vulnerabilities on the device. This suggests a targeted approach, aligned specifically with the attacker's smishing operations." It's believed the attackers are exploiting a now-patched information disclosure flaw impacting Milesight routers (CVE-2023-43261, CVSS score: 7.5), which was disclosed by security researcher Bipin Jitiya exactly two years ago. Weeks later, VulnCheck revealed that the vulnerability may have been weaponized in the wild shortly following public disclosure. Further investigation has revealed that some of the industrial routers expose SMS-related features, including sending messages or viewing SMS history, without requiring any form of authentication. The attacks likely involve an initial validation phase where the threat actors attempt to verify whether a given router can send SMS messages by targeting a phone number under their control. SEKOIA further noted that the API could also be publicly accessible due to misconfigurations, given that a couple of routers have been found running more recent firmware versions that are not susceptible to CVE-2023-43261. The phishing URLs distributed using this method include JavaScript that checks whether the page is being accessed from a mobile device before serving the malicious content, which, in turn, urges users to update their banking information for purported reimbursement. What's more, one of the domains used in the campaigns between January and April 2025 – jnsi[.]xyz – feature JavaScript code to disable right-click actions and browser debugging tools in an attempt to hinder analysis efforts. Some of the pages have also been found to log visitor connections to a Telegram bot named GroozaBot, which is operated by an actor named "Gro_oza," who appears to speak both Arabic and French. "The smishing campaigns appear to have been conducted through the exploitation of vulnerable cellular routers – a relatively unsophisticated, yet effective, delivery vector," SEKOIA said. "These devices are particularly appealing to threat actors as they enable decentralised SMS distribution across multiple countries, complicating both detection and takedown efforts."

A newly identified wave of smishing attacks has been traced to exploited Milesight Industrial Cellular Routers. According to research by Sekoia.io’s Threat Detection & Research (TDR) team, the routers’ APIs were abused to send phishing text messages – a tactic that has repeatedly targeted Belgian users by impersonating official government services. The malicious activity was first detected on July 22 2025, when honeypots recorded suspicious requests. Investigators found the routers had been manipulated to send SMS messages containing phishing links, often disguised as communications from CSAM and eBox (two widely used Belgian government platforms). Messages were written in Dutch and French and consistently featured Belgium’s +32 country code. Sekoia noted that over 19,000 routers of this type are accessible on the public internet. Of these, at least 572 are exposed to unauthenticated access, enabling attackers to send or retrieve SMS messages. Logs suggest the technique has been used since at least February 2022. Belgium in the Crosshairs Although campaigns have reached France, Italy, Sweden and other countries, Belgium remains the most frequent target. Between November 2022 and July 2025, multiple distinct operations impersonated federal authentication and digital mailbox services. In June and July 2025 alone, several new phishing domains mimicking these services were registered. The smishing campaigns often follow a validation phase: attackers test whether a compromised router can send SMS messages by directing initial texts to numbers they control. Once confirmed, the devices are used to launch mass phishing waves. Wide-Reaching Fraud The infrastructure supporting these campaigns appears tied to Lithuanian hosting provider Podaon, with phishing domains frequently registered through NameSilo. Some sites even employed scripts to restrict access from non-mobile devices, limiting detection by analysts. Sekoia.io’s findings highlight how vulnerable equipment is leveraged to conduct wide-reaching fraud. The campaigns typically impersonated services such as: Belgian CSAM and eBox French banking and postal organizations Telecom providers in Sweden and Denmark A Persistent Threat “Smishing continues to represent a significant and evolving threat,” Sekoia researchers warned. By exploiting relatively unsophisticated devices, attackers can operate at scale, distributing fraudulent messages across multiple countries. “In light of this, heightened vigilance remains essential. Users should be cautious of unsolicited messages – especially those containing shortened or suspicious URLs, spelling or grammatical errors or urgent calls to action,” the company explained. “Awareness and scepticism are among the most effective defences against smishing attempts, which increasingly target both individuals and organisations on a global scale.”