Act
active
eMudhra Intermediate CA Private Keys Compromised, MitM Risk
- Engineer — Act: Audit your certificate inventory now for any eMudhra-issued TLS certs; any certificate signed by one of the eight compromised intermediates must be replaced and the intermediates should be distrusted in your trust stores.
- SOC/IR — Plan: No IOCs are published yet, but build or tune detections for certificate validation failures and unexpected CA chain presentations that could indicate MitM use of fraudulently issued eMudhra certs; add eMudhra intermediate serial numbers to watchlists once revocation details are public.
- Leader — Act: Confirm with your security team whether any customer-facing or internal services rely on eMudhra-issued certificates; if so, request remediation status and prepare to notify affected parties given the MitM interception risk this poses to encrypted communications.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.