February 20, 2016 By Paul Sabanal 2 min read

The Internet of Things (IoT) is upon us. Everything from cars to home appliances, watches and even children’s toys are being connected online. It is projected that by the year 2020, there will be more 25 billion devices connected to the Internet.

Those numbers alone are enough to attract cybercriminals’ attention, but what is more relevant here is what these devices represent. It means more data to steal, more systems to take over and more money to be made.

The Next Evolution of Malware

In the past, this same line of reasoning sparked the evolution of malware. In the dawn of the Internet, we saw the proliferation of mass-mailing worms, when prior to that we had only seen file infectors and macro viruses. When Internet use became increasingly widespread in the early 2000s, financially motivated attackers took notice. That’s when we started seeing the likes of botnets, exploit kits and ransomware. We believe the rise of IoT will bring another evolution in malware in the form of thingbots.

Thingbots are botnets composed of infected IoT devices. These devices can be controlled by an owner to launch attacks, steal sensitive data or facilitate other malicious activities. We have already seen a few of these in the last couple of years.

Beware of Thingbots

Due to their ubiquity and the fact that they are usually connected directly to the Internet, wireless routers and modems are the primary targets for thingbots. Other devices that were targeted included network cameras and network storage systems. Most of these devices use Linux as their operating system, and this allows attackers to take existing Linux malware and recompile it to target the specific architecture the device is running on.

Access was gained on these devices mostly through Telnet default login credentials that the device owners left unchanged. There were also reports of infections through device vulnerabilities, as well. Distributed denial-of-service (DDoS) attacks were the primary use for the infected devices.

We believe that the current crop of IoT malware has not displayed a fraction of its potential yet. We know and expect that it will definitely increase in number, and it’s not a matter of if but how the malware will increase in sophistication. So we ask: What are thingbots capable of in the future? And most importantly, how can we protect ourselves from them?

Read the IBM Research Report: The inside story on botnets

More from Advanced Threats

Hive0051 goes all in with a triple threat

13 min read - As of April 2024, IBM X-Force is tracking new waves of Russian state-sponsored Hive0051 (aka UAC-0010, Gamaredon) activity featuring new iterations of Gamma malware first observed in November 2023. These discoveries follow late October 2023 findings, detailing Hive0051's use of a novel multi-channel method of rapidly rotating C2 infrastructure (DNS Fluxing) to deliver new Gamma malware variants, facilitating more than a thousand infections in a single day. An examination of a sample of the lures associated with the ongoing activity reveals…

GootBot – Gootloader’s new approach to post-exploitation

8 min read - IBM X-Force discovered a new variant of Gootloader — the "GootBot" implant — which facilitates stealthy lateral movement and makes detection and blocking of Gootloader campaigns more difficult within enterprise environments. X-Force observed these campaigns leveraging SEO poisoning, wagering on unsuspecting victims' search activity, which we analyze further in the blog. The Gootloader group’s introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using off-the-shelf tools for C2…

Black Hat 2022 Sneak Peek: How to Build a Threat Hunting Program

4 min read - You may recall my previous blog post about how our X-Force veteran threat hunter Neil Wyler (a.k.a “Grifter”) discovered nation-state attackers exfiltrating unencrypted, personally identifiable information (PII) from a company’s network, unbeknownst to the security team. The post highlighted why threat hunting should be a baseline activity in any environment. Before you can embark on a threat hunting exercise, however, it’s important to understand how to build, implement and mature a repeatable, internal threat hunting program. What are the components…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today