BAMBOOZLED

WOWZA-CERT responded to an alert on WZ-IOT-GW03, a sensor data aggregator in Wowza Manufacturing's factory network. The SIEM flagged anomalous traffic on an unauthorized port. The team recovered a suspicious implant from the gateway and captured network traffic from the incident window.

The implant appears to communicate with an external controller, but the protocol is heavily obfuscated. The gateway normally handles legitimate sensor feeds, the attacker may have exploited this to blend in.