A massive botnet, Eleven11bot, composed of over 30,000 hacked security cameras and network video recorders, is launching DDoS attacks on telecom providers and gaming platforms. Researchers from Nokia Deepfield and GreyNoise have linked over 60% of the botnet’s IPs to Iran, though no formal attribution has been made. The botnet exploits weak/default passwords on IoT devices and brute-forces Telnet and SSH credentials.

The botnet primarily exploits vulnerabilities in IoT devices, with a focus on hardcoded credentials found in VStarcam security cameras. Its attack traffic fluctuates from hundreds of thousands to millions of packets per second, making it a significant threat. Researchers note that 96% of the compromised devices are genuine, actively accessible systems rather than spoofed sources.

Stay secure and protect your networks!