- A new botnet called eleven11bot was discovered in nature
- It utilizes weak and default information to compromise IoT -devices
- Botnet is run by Iranian threat players
CyberSecurity scientists say they have revealed the “biggest non-governmental botnet” in recent years.
It’s called Eleven11bot, and its malware was found on more than 86,000 Internet of Things (IoT) devices, according to several research teams, including Nokia, Greynoise and Shadows Server Foundation.
Botnet is probably driven by an Iranian threat actor, reported Greynoise. It found approx. 1,400 IPs serving botnet, the majority of which is based in Middle Eastern country. The threat actors appear to hunt for IoT devices with factory or weak credentials and actively scan for exposed Telnet and SSH ports, with compromised devices including webcams, network video recorders (NVR) and the like.
Extraordinary size
At the same time, the Shadows Server Foundation analyzed the spread of malware and found that the majority of compromised final points are located in the US, UK, Mexico, Canada and Australia.
Botnets are most commonly used for distributed attacks on the denial of service (DDOS), where infected devices overwhelm a target server that causes disturbance.
They are also used to send massive spam campaigns, distribute phishing -e emails or malware while avoiding detection. Cyber criminals are utilizing botnets for credentials and brute-force attacks trying to break in accounts using stolen credentials.
Another frequent use is click fraud where infected machines generate fake ad click to inflate revenue. Botnets also enables cryptojacking, secretly mining cryptocurrency on the victims’ devices, slows them down and increases electricity costs. In addition, they are used for data theft and espionage, stealing login -credentials, financial data or trade secrets.
Via Bleeping computer
