MITRE expands ICS threat-hunting guidance as CISA flags critical EseeCloud camera flaws

MITRE has added new ICS techniques, detection strategies and analytics, while CISA warns that unpatched EseeCloud camera flaws could enable full device takeover.

MITRE’s latest ATT&CK release has widened its coverage of industrial control systems, adding a new ICS command-and-scripting category, extra command-and-control sub-techniques and fresh detection guidance aimed at distinguishing suspicious behaviour from routine engineering work and authorised maintenance. The update also folds in new critical-infrastructure campaigns, underscoring how defenders can better map known tradecraft to telemetry, but it is still a knowledge base rather than a set of ready-made product rules. MITRE says the changes include nine new ICS detection strategies and 22 new ICS analytics, reflecting a broader push to make OT threat hunting more operationally useful without implying that the release itself signals a new compromise or patching event.

Separately, CISA has warned about three vulnerabilities in Guangzhou Juan IoT Technology’s EseeCloud ecosystem, affecting App versions 4.9.6 and earlier and firmware 4.9.86.0 and earlier. The advisory says successful exploitation could allow an attacker to take control of affected IP cameras and gives the issue a vendor-equipment CVSS score of 9.8. One of the flaws is a hard-coded credential weakness, while the other two involve flawed object handling and an observable response discrepancy. CISA said it had not received reports of public exploitation at the time of publication and listed no fixed version, leaving defenders to focus on reducing internet exposure, tightening segmentation and using secure remote-access methods where business needs require them.