IOTroop Botnet Hits Over a Million Organizations in Under 30 Days

A new IoT botnet dubbed IOTroop is expected to spread faster than Mirai because it has infected more than 1 million organizations since its discovery in late September, according to Check Point Software Technologies, which made the discovery.

IOTroop's malware seeks out vulnerabilities in wireless IP camera devices, such as GoAhead, D-Link, TP-Link, AVTECH, NETGEAR, MikroTik, Linksys, and others, Check Point states. "The malware is able to spread faster than Mirai for it leverages numerous vulnerabilities, rather than only compromising devices that use default credentials," says Maya Horowitz, Check Point's group manager of Threat Intelligence.

Although IOTroop shares some technical aspects with Mirai, Check Point stresses it is a new botnet with a far more sophisticated attack campaign. IOTroop, for example, uses the Internet of Things devices that it infects to scan additional devices and report back to the command-and-control server with its findings, Horowitz says. This helps IOTroop to accelerate the speed at which it spreads, she notes. IOTroop takes advantage of users' failure to patch existing vulnerabilities in their IoT devices, and also the ability to launch its malware without human interaction.

Read more about IOTroop here.