Welcome to our weekly newsletter where we share some of the major developments on the future of cybersecurity that you need to know about. Make sure to follow my LinkedIn page as well as Echelon’s LinkedIn page to receive updates on the future of cybersecurity!
To receive these and other curated updates to your inbox on a regular basis, please sign up for our email list here: https://echeloncyber.com/ciw-subscribe
Echelon Events & Thought Leadership Highlight
We've heard from clients time and time again that they are buying tools without being able to manage or monitor them internally. The tool isn't being used to its full potential, money is getting thrown out the window, and the team is drowning in alerts they don't have the bandwidth to deal with.
We've listened.
Introducing Echelon MDR, Powered by CrowdStrike: a fully managed detection and response service that operates and extends the Falcon platform on your behalf, including around the clock monitoring, triage, investigation, and response.
You get SOC outcomes without building a SOC, backed by certified engineers from our CrowdStrike Center of Excellence.
💡 Learn more here: https://lnkd.in/eXuMUinn
📰 Read the full announcement: https://lnkd.in/em3meRBe
Away we go!
1. Hackers Tore Apart a Flock Camera and Found 1.6 Million Images Inside
A hacker collective physically removed a Flock Safety license plate recognition camera from above a roadway, gained access to its Android-based operating system and copied much of the information stored on the device. What they found provides an unusually detailed look at how these increasingly common roadside cameras operate. According to an analysis by WIRED and 404 Media, the camera had recorded approximately 50,200 vehicles and generated 1.6 million images during roughly 21 days of recoverable activity. A typical passing vehicle generated around 28 images, while some triggered more than 100. The device captured different exposures, selected useful frames and transmitted images and related information over a cellular connection to Flock's servers for further analysis.
The security implications are just as interesting as the scale of the collection. Flock has said its cameras use on-device encryption, and investigators found that much of the device's most sensitive storage remained encrypted. But the hackers also discovered an encryption key stored on the camera itself. That key allowed them to unlock thousands of locally stored videos and images. The attackers said they found unencrypted Android partitions, including a media partition containing the key needed to decrypt another portion of the device's storage. It is an important reminder that encryption is only as strong as the protection surrounding the keys. Encrypting data at rest provides far less protection if someone who physically compromises the device can also retrieve the key required to decrypt it.
The recovered software also revealed more about what the cameras can see. In addition to vehicles and license plates, the computer vision models running on the device explicitly detect people and bicycles. Researchers extracted the models and tested them against images and more than 27,000 short video clips recovered from the camera, confirming that the software could detect people. The system also occasionally interpreted bumper stickers, dealership frames and other graphics as license plates. In one example, it isolated an American flag patch on a motorcyclist's saddlebag. The investigation found no evidence that Flock's software was performing facial recognition, which the company has said its cameras do not use.
For security leaders, there is a lesson here that extends well beyond Flock. Edge computing devices increasingly sit outside the physical perimeter while collecting sensitive information and communicating with centralized cloud platforms. Cameras, sensors, kiosks, IoT systems and industrial equipment should therefore be designed under the assumption that someone may eventually obtain physical access to the hardware. Encryption keys should be protected separately from the information they secure, local data retention should be minimized, secure boot and hardware-backed key storage should be considered, and physical compromise should not automatically become data compromise. Flock said the camera was removed and tampered with without authorization and encouraged anyone identifying legitimate vulnerabilities to report them through its vulnerability disclosure process. Regardless of how this particular device was obtained, the technical lesson is valuable: if sensitive data exists on an edge device, organizations should design that device as though it may eventually end up in someone else's hands.
Amazon EKS Flaw Could Allow Pods to Bypass Network Policies
AWS disclosed a new vulnerability this week affecting network policy enforcement in Amazon Elastic Kubernetes Service (EKS). Tracked as CVE-2026-86831, the vulnerability exists in versions of the Amazon EKS Network Policy Agent prior to 1.4.0 and can potentially allow a Kubernetes pod to bypass NetworkPolicy restrictions and communicate across namespaces when it should not be able to do so.
The vulnerability comes down to something surprisingly simple. The Network Policy Agent created pod identifiers by combining the pod name and namespace using a hyphen. Because hyphens are valid characters in both names, different combinations could result in the same identifier. For example, a pod named api-prod in namespace finance could theoretically collide with a pod named api in namespace prod-finance. When those identities become ambiguous, the network policy engine can potentially apply the wrong policy and undermine the segmentation organizations expect Kubernetes NetworkPolicy to provide.
AWS has released fixes, and organizations running EKS should upgrade the Network Policy Agent to version 1.4.0 or later and the Amazon VPC CNI Managed Add-on to version 1.22.4 or later. AWS also provides a temporary mitigation for organizations that cannot patch immediately: avoid hyphens in Kubernetes namespace names. Security teams should inventory EKS clusters using Network Policy Agent, verify installed versions, review namespace naming conventions and pay particular attention to environments where NetworkPolicy is being relied upon to isolate sensitive workloads.
Why it matters: Kubernetes network policies are often treated as an important east-west security boundary. Imagine a compromised internet-facing application pod that is supposed to communicate only with a limited set of services. If an attacker can manipulate pod and namespace naming to create an identity collision, the network segmentation designed to prevent movement toward a database, administrative service or another sensitive workload may no longer behave as expected. This is another reminder that cloud-native security controls need to be tested like any other software. Do not simply verify that a NetworkPolicy exists. Validate that the traffic it is supposed to block is actually blocked.
2. CISA Says It’s Time to Give Hackers Something Fake to Steal
CISA is encouraging organizations to add a surprisingly old-school technique to their modern Zero Trust strategies: deception. New guidance released September 16 outlines how organizations can deploy cyber decoys, including honeypots, honeytokens, tripwires, breadcrumbs and other fake assets designed specifically to attract or detect attackers. The concept fits naturally with Zero Trust. If you assume an attacker may eventually get inside your environment, you can deliberately give that attacker something enticing to find and generate an alert the moment they interact with it. CISA's guidance is particularly notable because it is aimed not only at sophisticated security operations centers, but also at small and midsized organizations looking for practical ways to improve detection and response.
The simplest implementations can be surprisingly effective. Imagine placing a file called Executive Passwords.xlsx somewhere no legitimate employee has any reason to open, planting a fake AWS access key inside a development environment, or creating a service account credential that is never actually used. Those assets have virtually no legitimate activity associated with them. If someone accesses the spreadsheet or attempts to authenticate using the fake credential, the signal is fundamentally different from another failed login buried among thousands of security events. Something is almost certainly wrong. CISA organizes these techniques around three objectives drawn from MITRE Engage: Expose, to identify adversaries operating inside an environment; Affect, to waste their time and disrupt their operations; and Elicit, to observe their behavior and collect useful threat intelligence.
That high signal-to-noise ratio is what makes deception particularly interesting in an era of alert fatigue. Security teams spend enormous amounts of time correlating endpoint, identity, firewall and cloud telemetry to determine whether activity is actually malicious. A well-designed honeytoken reverses the equation. Nobody should be using it, so any use becomes inherently suspicious. That does not mean every company needs an elaborate network of honeypots. A handful of strategically placed decoy credentials, documents, URLs or systems can provide meaningful detection value at relatively low cost. The approach also needs operational discipline. Decoys should be isolated, monitored and incorporated into incident response procedures so a compromised honeypot cannot become infrastructure an attacker uses to move elsewhere.
There is also an important question of priorities. Organizations struggling to deploy MFA, patch critical vulnerabilities or respond to existing high-priority alerts probably should not divert substantial resources into an elaborate deception platform. But deception does not have to be elaborate. Once the fundamentals are working, a few carefully positioned tripwires can become an inexpensive additional layer of defense. The larger lesson from CISA is worth remembering: cybersecurity does not always have to be passive. If we already assume attackers will eventually find a way inside, there is value in shaping what they find when they get there and making sure some of the most attractive doors they try to open lead directly to the security team.
Attackers Are Moving From Using AI as an Assistant to Using It as an Operator
One of the most important AI security developments this week is not a single vulnerability that can be fixed with a patch. Anthropic released new threat intelligence detailing malicious activity its researchers identified and disrupted involving Claude. The findings reinforce an important shift security teams should be watching: threat actors are increasingly attempting to integrate generative AI into real cyber operations rather than simply using a chatbot to answer technical questions.
That distinction matters. An attacker asking an AI model how a technology works is essentially using a faster search engine or technical assistant. An attacker connecting AI to tools, scripts, infrastructure and multistep workflows is something different. The model can help analyze information, adapt tactics, write or modify code, process stolen data and accelerate portions of an operation. This does not magically give inexperienced attackers elite capabilities, but it can dramatically compress the time required to perform tasks that previously demanded significant manual effort.
There is no software update that fixes this problem. Instead, defenders need to assume that AI will continue reducing the time between vulnerability disclosure, attacker research and operational exploitation. Prioritize vulnerabilities based on exploitability and exposure rather than CVSS scores alone. Reduce unnecessary internet-facing services. Require phishing-resistant MFA for privileged access. Monitor identity and endpoint behavior for activity that deviates from normal patterns, and build incident response processes capable of moving at machine speed. Organizations deploying their own agents should apply the same thinking internally: tightly restrict tool access, isolate agents processing untrusted content, use short-lived credentials and put authorization controls outside the model.
Why it matters: AI is unlikely to replace sophisticated attackers. It may make sophisticated attack techniques available faster and at greater scale. That changes the economics of cyber defense. A vulnerability that once gave defenders several weeks before widespread exploitation may eventually give them days or hours. The practical response is not fear of AI. It is reducing the amount of time your organization needs to identify its most dangerous exposures, contain compromised identities and respond when something starts behaving abnormally.
3. FBI and Coast Guard Respond After Suspected Cyberattack on U.S.-Bound Oil Tanker
A suspected cyberattack against a massive oil tanker headed for Texas triggered an unusual response from the U.S. government, with Coast Guard cybersecurity specialists and FBI agents boarding the vessel in the Atlantic to investigate and remove a potential threat. The Coast Guard confirmed that authorities had indications the ship's network may have been compromised by a foreign actor. Iranian state media identified the vessel as the VL Prosperity, a 333-meter crude oil tanker capable of carrying roughly 2.3 million barrels of oil that was traveling toward Galveston, Texas. U.S. officials have not publicly attributed the incident to Iran or any other specific actor.
What actually happened aboard the tanker remains an important unanswered question. Iranian state media claimed attackers penetrated engine-room systems, interfered with cooling, fuel and lubrication systems, altered engine speed and disrupted communications for roughly 30 hours. Those claims have not been confirmed by U.S. authorities. What has been confirmed is significant enough on its own. On August 21, a team that included Coast Guard law enforcement personnel, a vessel inspector, Coast Guard Cyber Protection Team members and FBI Cyber Action Team operators boarded the tanker. They examined both the vessel's traditional IT environment and its operational technology, worked alongside the crew and corporate operators, and took steps to eradicate the suspected threat. The Coast Guard later said there were no reports of vessel instability, physical danger to the crew, operational disruption or environmental impact.
The incident illustrates why maritime cybersecurity has become a critical infrastructure issue. A modern commercial vessel is effectively a floating industrial environment, filled with interconnected systems responsible for navigation, propulsion, communications and cargo operations. Compromising an employee laptop aboard a ship is one thing. Reaching the operational technology controlling a vessel that weighs hundreds of thousands of tons and carries millions of barrels of oil creates an entirely different category of risk. The potential consequences extend beyond data theft to human safety, environmental damage, supply chain disruption and, in an extreme scenario, the physical security of ports and other maritime infrastructure.
For organizations operating ships, ports, manufacturing facilities, utilities and other industrial environments, the lesson is straightforward: IT and OT can no longer be treated as separate cybersecurity conversations. Organizations need to understand exactly where those environments connect, strictly control remote access, segment critical control systems, monitor communication between IT and OT networks, and build incident response plans that account for cyber events with physical consequences. The fact that Coast Guard cyber specialists and FBI operators physically boarded this vessel is perhaps the most telling part of the story. Cybersecurity is no longer confined to a SOC or data center. When software controls machinery, a cyber incident can quickly become an operational, safety and national security event.
Thanks for reading!
About us: Echelon is a full-service cybersecurity consultancy that offers wholistic cybersecurity program building through vCISO or more specific solutions like penetration testing, red teaming, security engineering, cybersecurity compliance, and much more! Learn more about Echelon here: https://echeloncyber.com/about