Another huge new botnet is infecting thousands of webcams and video recorders for DDoS attacks

Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol

(Image credit: Shutterstock)

A new botnet called Eleven11bot was spotted in the wild
It leverages weak and default credentials to compromise IoT devices
The botnet is operated by Iranian threat actors

Cybersecurity researchers say they have uncovered the “biggest non-government botnet” in recent years.

It is called Eleven11bot, and its malware was found on more than 86,000 Internet of Things (IoT) devices, according to multiple research teams, including Nokia, GreyNoise, and The Shadowserver Foundation.

The botnet is most likely operated by an Iranian threat actor, GreyNoise reported. It found some 1,400 IPs operating the botnet, the majority of which are based in the Middle Eastern country. The threat actors seem to be hunting for IoT devices with factory or weak credentials, and actively scanning for exposed Telnet and SSH ports, with compromised devices including webcams, Network Video Recorders (NVR), and similar.

Exceptional size

At the same time, The Shadowserver Foundation analyzed the spread of the malware, and found that the majority of compromised endpoints are located in the United States, United Kingdom, Mexico, Canada, and Australia.

Botnets are most commonly used for Distributed Denial-of-Service (DDoS) attacks, where infected devices overwhelm a target server, causing disruptions.

They are also used for sending massive spam campaigns, distributing phishing emails or malware while avoiding detection. Cybercriminals leverage botnets for credential stuffing and brute-force attacks, trying to break into accounts using stolen credentials.

Another frequent use is click fraud, where infected machines generate fake ad clicks to inflate revenue. Botnets also enable cryptojacking, secretly mining cryptocurrency on victims’ devices, slowing them down and increasing electricity costs. Additionally, they are used for data theft and espionage, stealing login credentials, financial data, or trade secrets.

Via BleepingComputer

Massive botnet is targeting Microsoft 365 accounts across the world
We've rounded up the best password managers
Take a look at our guide to the best authenticator app

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.