The Internet of Things (IoT) is upon us. Everything from cars to home appliances, watches and even children’s toys are being connected online. It is projected that by the year 2020, there will be more 25 billion devices connected to the Internet.

Those numbers alone are enough to attract cybercriminals’ attention, but what is more relevant here is what these devices represent. It means more data to steal, more systems to take over and more money to be made.

The Next Evolution of Malware

In the past, this same line of reasoning sparked the evolution of malware. In the dawn of the Internet, we saw the proliferation of mass-mailing worms, when prior to that we had only seen file infectors and macro viruses. When Internet use became increasingly widespread in the early 2000s, financially motivated attackers took notice. That’s when we started seeing the likes of botnets, exploit kits and ransomware. We believe the rise of IoT will bring another evolution in malware in the form of thingbots.

Thingbots are botnets composed of infected IoT devices. These devices can be controlled by an owner to launch attacks, steal sensitive data or facilitate other malicious activities. We have already seen a few of these in the last couple of years.

Beware of Thingbots

Due to their ubiquity and the fact that they are usually connected directly to the Internet, wireless routers and modems are the primary targets for thingbots. Other devices that were targeted included network cameras and network storage systems. Most of these devices use Linux as their operating system, and this allows attackers to take existing Linux malware and recompile it to target the specific architecture the device is running on.

Access was gained on these devices mostly through Telnet default login credentials that the device owners left unchanged. There were also reports of infections through device vulnerabilities, as well. Distributed denial-of-service (DDoS) attacks were the primary use for the infected devices.

We believe that the current crop of IoT malware has not displayed a fraction of its potential yet. We know and expect that it will definitely increase in number, and it’s not a matter of if but how the malware will increase in sophistication. So we ask: What are thingbots capable of in the future? And most importantly, how can we protect ourselves from them?

Read the IBM Research Report: The inside story on botnets

More from Advanced Threats

Black Hat 2022 Sneak Peek: How to Build a Threat Hunting Program

4 min read - You may recall my previous blog post about how our X-Force veteran threat hunter Neil Wyler (a.k.a “Grifter”) discovered nation-state attackers exfiltrating unencrypted, personally identifiable information (PII) from a company’s network, unbeknownst to the security team. The post highlighted why threat hunting should be a baseline activity in any environment. Before you can embark on a threat hunting exercise, however, it’s important to understand how to build, implement and mature a repeatable, internal threat hunting program. What are the components…

Top-Ranking Banking Trojan Ramnit Out to Steal Payment Card Data

4 min read - Shopping online is an increasingly popular endeavor, and it has accelerated since the COVID-19 pandemic. Online sales during the 2021 holiday season rose nearly 9% to a record $204.5 billion. Mastercard says that shopping jumped 8.5% this year compared to 2020 and 61.4% compared to pre-pandemic levels. Cyber criminals are not missing this trend. The Ramnit Trojan, in particular, is out for a shopping spree that’s designed to take over people’s online accounts and steal their payment card data. IBM…

Detections That Can Help You Identify Ransomware

12 min read - One of the benefits of being part of a global research-driven incident response firm like X-Force Incidence Response (IR) is that the team has the ability to take a step back and analyze incidents, identifying trends and commonalities that span geographies, industries and affiliations. Leveraging that access and knowledge against the ransomware threat has revealed tools, techniques and procedures that can often be detected through the default Windows event logs (WELs). In particular, the X-Force IR team has identified several…

Trickbot rising — Gang doubles down on infection efforts to amass network footholds

11 min read - IBM X-Force has been tracking the activity of ITG23, a prominent cybercrime gang also known as the TrickBot Gang and Wizard Spider. Researchers are seeing an aggressive expansion of the gang’s malware distribution channels, infecting enterprise users with Trickbot and BazarLoader. This move is leading to more ransomware attacks — particularly ones using the Conti ransomware. As of mid-2021, X-Force observed ITG23 partner with two additional malware distribution affiliates — Hive0106 (aka TA551) and Hive0107. These and other cybercrime vendors…