Threat video1:00
CVE-2026-25599 Orca Heat Pump Spoofing: Detection & IOCs
Orca heat pumps trust a bare device ID over HTTP, so attackers can impersonate them. Includes 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-25599 Orca Heat Pump Spoofing: Detection & IOCs →
Chapters
- 0:00The hookLegacy Orca heat pumps transmit unencrypted device identifiers.
- 0:05The storyLegacy terminals transmit device IDs in clear text.
- 0:12Attack pathAttackers reportedly exploit unencrypted terminal IDs to impersonate devices and submit malware.
- 0:31AttributionNo threat actor is attributed.
- 0:35Indicators of compromise1 indicator to hunt: 1 file name.
- 0:40MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to impact.
- 0:44Remediation3 steps now: Confirm Orca user portal is at version 1.19 or later.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Legacy Orca heat pumps transmit unencrypted device identifiers.
0:05Legacy terminals transmit device IDs in clear text.
0:09Attacker injects malware through the portal.
0:12Attackers reportedly exploit unencrypted terminal IDs to impersonate devices and submit malware.
0:20On vulnerable portals, version before 1.19, the malware executes in user browsers.
0:26Session cookies stolen, sent to attacker infrastructure.
0:31No threat actor is attributed. Confidence: low.
0:351 indicator to hunt: 1 file name.
0:407 ATT&CK techniques, from initial access to impact.
0:453 steps now: Confirm Orca user portal is at version 1.19 or later.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.