As Mirai has shown, IoT devices are becoming the cyberweapon delivery system of choice by today’s botnet-building attackers. In the future, these botnets, or “thingbots,” will become the infrastructure for a future darknet.
That’s the assessment of F5, which has tracked escalating activity on the thingbot front.
“There are literally billions of [IoT devices] in the world, most of which are readily accessible (via Telnet) and easily hacked (due to lack of security controls),” the firm said in a report on the subject. “Why would attackers rent expensive resources in hosting environments to build their botnets when so many devices are free for the taking?”
Based on analysis of data collected between January 1 through June 30, 2017, Telnet attack activity grew 280% from the previous period, which included massive growth due to the Mirai malware and subsequent attacks. Unfortunately,
Mirai (and its kindred botnet, Persirai) looks to be the tip of the proverbial iceberg.
“The level of attacking activity [is exponentially larger than what it took to build Mirai],” the report noted. “[It] doesn’t equate to the current size of Mirai or
Persirai,
indicating there are other thingbots being built that we don’t yet know about. Since there haven’t been any massive attacks post Mirai, it’s likely these thingbots are just ready and waiting to unleash their next round of attacks.”
