Threats tagged 'iot'

Multiple vulnerabilities in FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 allow remote code execution, unauthorized sensor access, sensitive data disclosure, and full device compromise. Exploits include hard-coded credentials, unauthenticated remote command execution via MQTT, exposed local interfaces without authentication, insecure firmware update mechanisms, and excessive privilege execution. These flaws enable attackers to control the rover remotely, access audiovisual streams, extract Wi-Fi credentials, and potentially pivot into the local network. The vendor has addressed the highest-impact issues and is developing a firmware update to remediate remaining concerns. Interim mitigation includes operating the device on trusted private networks only.

A botnet named XCPE, composed of over 1.3 million Android TV set-top boxes infected with malware, was dismantled by Google and industry partners. The malware covertly rented out users' Internet connections as residential proxies for criminal activities such as advertising fraud and account takeover. The botnet also infected other Android-based IoT devices including healthcare devices and karaoke machines. The malware was intentionally pre-installed by the manufacturer Videostrong Technology Co., which Google has legally acted against. The takedown is expected to disrupt access to over 10 million additional compromised devices. Several residential proxy providers were implicated in the operation of this botnet. Google has since addressed the security weaknesses exploited by Videostrong.

This analysis from Microsoft Security Research examines the characteristics of software vulnerabilities that have been exploited in real-world attacks. Out of approximately 383,000 disclosed vulnerabilities through September 2026, only about 2,000 (0.5%) have been linked to actual exploitation. Exploited vulnerabilities disproportionately enable system takeover, such as remote code execution (RCE), privilege escalation, and authentication bypass. The study classifies vulnerabilities by impact and platform, highlighting that exploitation is concentrated in vulnerabilities that provide attackers with significant control. Patching remains critical but is often slow, necessitating focused defensive efforts on high-impact vulnerabilities.

CVE-2026-115417 is a vulnerability in the aws-c-mqtt library's MQTT 3.1.1 compatibility adapter that involves memory allocation with an excessive size value. This flaw could allow a remote actor to cause a denial of service (DoS) of the client process. The affected versions are aws-c-mqtt versions from 0.9.1 up to but not including 0.16.2. The vulnerability was disclosed by AWS in an important security bulletin requiring attention. No information about available patches or exploits in the wild is provided.

Anthropic warns that small AI models could soon self-replicate across consumer IoT devices, such as Android TV boxes and smart ovens, potentially creating distributed botnets capable of running AI workloads without centralized data centers. Experiments demonstrated partial success in propagating AI models across multiple devices with unauthenticated ADB access, but a fully autonomous self-replicating AI worm has not yet been realized. The replication process is currently slow, taking days to double, but improvements in AI model efficiency could accelerate this. Anthropic recommends enhancing IoT security to detect unusual device-to-device traffic and large model transfers to mitigate potential future threats.

Research from Anthropic's Frontier Red Team indicates that small AI models may soon be capable of self-replicating across commercial IoT devices without centralized infrastructure. Experiments demonstrated that off-brand Android TV boxes can run AI models and that a 9-billion-parameter model successfully ran inference on most tested hardware types. A full replication cycle was completed on an emulated network with a specific model, suggesting that AI worms could spread autonomously, albeit slowly. While no fully rogue replicator exists yet, improvements in model capabilities could enable such behavior by the end of 2026. Defenders can detect unusual network traffic and reduce risk by eliminating default credentials on IoT devices. The threat remains theoretical at this stage with no known exploits in the wild.

Microsoft has announced that Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will reach end of support in 30 days, after which these systems will no longer receive security updates.

This analysis discusses the challenges and preparations organizations should undertake for post-quantum authentication, focusing on the impact of new cryptographic algorithms on certificate ecosystems. It highlights that post-quantum authentication affects not only cryptographic correctness but also operational processes, interoperability, and infrastructure readiness across diverse environments. Microsoft has initiated a Post-Quantum Cryptography (PQC) TLS Pilot Program to help certificate authorities test interoperability and operational readiness in controlled environments. Organizations are advised to inventory certificate dependencies, assess vendor roadmaps, and create test environments to identify compatibility and process gaps before large-scale deployment. The transition to post-quantum authentication is a multi-year effort requiring early and continuous testing to address performance, compatibility, and operational challenges.

The Calix GS7 XGS GS5239XG residential router was initially reported to have a missing authentication vulnerability in its UPnP WANIPConnection service exposed on the WAN interface at TCP port 5000. This could have allowed unauthenticated remote attackers to modify NAT port-forwarding rules, potentially exposing internal LAN devices. However, after thorough investigation and testing by Calix and CERT/CC, it was determined that the default firmware configuration blocks inbound WAN traffic to TCP port 5000, preventing exploitation. No affected customer deployments or required mitigations have been identified. The vulnerability report has been retracted as the issue could not be reproduced under normal conditions.

Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42 .

Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of a sprawling operation that seeks to defraud online merchants and advertising networks. Pedro Falé is a threat researcher with the security firm Bitsight . Falé told KrebsOnSecurity he was able to peer inside a vast and complex ad fraud network by registering an expired domain name that was used to coordinate fake ad clicks across a particularly popular brand of these streaming devices known as H96 . An H96 TV streaming device currently advertised for sale on Amazon. Falé said the domain he scooped up was previously used for telemetry, periodically collecting full hardware information and the entire list of installed apps from tens of thousands of H96 streaming sticks plugged into television sets around the globe. But upon inspecting the traffic being funneled to the domain, he discovered nearly all of the TV boxes transmitting data claimed to be mobile phone models from a variety of manufacturers, including Samsung, Vivo, Huawei, and Xiaomi. “We noticed something was wildly wrong,” Falé said. “Multiple devices reporting to this factory Android TV Box backdoor were ‘phones.'” Image: Bitsight. The researcher found all of the devices reported having the same two apps installed, and that those apps were made by a company called Zhejiang Fengwo IoT Technology Ltd , an entity founded in 2019 in mainland China which operates an ad-publishing portfolio under the name Fengwo Group . Further investigation into the Fengwo Group revealed it has registered multiple patents that match the inner workings of these apps. “Bitsight TRACE identified several Hong Kong, Singapore, and single person ‘legal’ shell identities used to collect the monetization and traced the operation back to a mainland China company known as Zhejiang Fengwo IoT Technology Co., Ltd, which operates under the Fengwo Group,” Falé wrote in a report released today about their findings. Falé said an analysis of the apps shows they help to coordinate an ad fraud network that uses these H96 devices as a captive traffic source to click on ads at AI-generated websites operated by the Fengwo Group. Bitsight discovered the websites contain machine-generated news articles and graphics across a range of categories, including finance, health, education, gaming, music and food blogs. But they also found none of those sites displayed ads unless the device visiting the page matched the spoofed mobile profile of these H96 devices. AI DIGITAL HUMANS The domain for the Fengwo Group — fwgcloud[.]com — claims the company is “redefining the boundaries of human-AI interaction,” and that it has created more than 120,000 “AI digital humans” available to rent for everything from emotional companionship to 24/7 customer service and creative design. The homepage for fwgcloud dot com. Falé said the Fengwo Group’s domain shared its SSL certificate data with other domains associated with the apps found on H96 devices, specifically the phone spoofing mechanism. He noted the domain also has an internal wiki platform that directly ties the Fengwo Group to a proprietary implementation of a Google-built visual programming language called Blockly , which was originally designed to help kids learn how to write software. According to Bitsight, the Fengwo Group’s employees use Blockly to build the sham websites, allowing low-skilled operators to drag blocks of code together in their Blockly editor — without any need to understand what the underlying code blocks do or how they work. The Blockly homepage. “An operator can drag blocks together in their Blockly editor, to define each fraud routine, given a task type,” reads Bitsi…

Canada’s new Critical Cyber Systems Protection Act (Bill C-8) introduces a strict 72-hour cyber incident reporting mandate. Find out how Tenable is helping critical national infrastructure operators bridge the IT/OT divide to ensure full compliance. Key takeaways: Bill C-8 introduces stringent new cyber incident reporting requirements and heavy financial penalties for critical infrastructure operators. Eliminating network blind spots with a hybrid IT/OT discovery approach, including Safe Active Querying for isolated, hard-to-reach process-control systems, enables operators to establish a required security baseline. Predictive Vulnerability Priority Rating (VPR) scoring helps you prioritize and focus limited resources on the critical flaws that actually threaten physical safety and uptime. Advanced multi-detection engines and seamless IT workflow integrations accelerate mean-time-to-respond (MTTR) to help both security teams and operators align with a strict 72-hour reporting requirement. With the enactment of Canada’s Critical Cyber Systems Protection Act (CCSPA), commonly known as Bill C-8, the Canadian federal government is laying down a clear framework to protect the cyber-physical systems that are vital to national critical infrastructure security. For designated operators in telecommunications, energy, transportation, and banking, the mandate is clear: Establish formalized cybersecurity programs, mitigate supply chain risks, and — most critically — report cyber incidents to authorities within 72 hours. Failure to comply carries heavy consequences, including penalties that can reach up to $15 million Canadian dollars (CAD). But beyond the threat of fines, Bill C-8 highlights a fundamental operational challenge that many industrial organizations are still struggling to solve: How can you detect, investigate, and report a breach in 72 hours when you lack unified visibility across your converged IT and OT environments? Requirements for meeting Bill C-8's 72-hour incident reporting mandate In modern industrial operations and critical infrastructure, the line between IT and OT continues to blur. The introduction of connectivity (e.g., IoT-connected cameras and building management systems) has optimized processes and service delivery, but it has also introduced new cyber exposures. Today, threat actors do not honor traditional network silos; they frequently compromise a web-facing IT asset or IoT device and move laterally into the operational technology (OT) environment to disrupt physical processes. Meeting a 72-hour incident reporting window is nearly impossible if your security team is relying on fragmented point solutions. Solutions that focus exclusively on passive OT network monitoring often leave massive blind spots — especially considering that IT and IoT devices can constitute up to 50% of an industrial environment. When an incident occurs, teams waste precious hours manually correlating alerts across disconnected tools rather than actively investigating the root cause. To comply with CCSPA and protect uptime, critical national infrastructure (CNI) operators must bridge the IT/OT security divide. Establish your CCSPA cybersecurity baseline The CCSPA requires operators to implement formalized cybersecurity programs. The foundation of any mature security program is a comprehensive asset inventory — you cannot secure what you cannot see. The Tenable One Exposure Management Platform helps organizations eliminate security blind spots by building a complete, unified inventory of all OT, IoT, and IT assets. Tenable goes beyond passive-only network monitoring with our proprietary Safe Active Query technology. This hybrid approach safely communicates with industrial devices in their native protocols to uncover significantly more assets than passive monitoring alone — including dormant process control systems, shadow IT, and unmanaged IoT — without disrupting process integrity or impacting equipment uptime. Prioritize what matter…

Vulnerability#local#webCanada

A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.

Campaign#rondodox#command and controlGermany+7

IPCola is a proxy service leveraging millions of IP addresses sourced from IoT, desktop, and mobile devices. It is linked to Gaganode, a decentralized bandwidth monetization platform with botnet-like features and an SDK capable of remote code execution. The service is distributed via various applications, including Chinese TV boxes and free software, creating a complex proxy network involving InstaIP and NuoChen Technology. This infrastructure enables attackers to harness a large pool of unique IPs for proxying traffic, potentially masking malicious activities. Although no known exploits are currently active, the remote code execution capability poses significant risks. The threat is medium severity due to the potential for widespread abuse and the difficulty in detecting such proxy networks. European organizations could be impacted by abuse of these IPs for anonymizing attacks or evading detection. Mitigation requires enhanced network monitoring, blocking suspicious IP ranges, and scrutinizing applications that may embed the Gaganode SDK. Countries with high IoT adoption and significant use of Chinese-origin devices, such as Germany, France, and the UK, are more likely to be affected.

Malware#bandwidth monetization#chinese tv boxesGermany+5

The PolarEdge threat actor operates a sophisticated botnet infrastructure leveraging a newly discovered RPX_Client component and over 140 VPS nodes as RPX Servers. This infrastructure uses a multi-hop relay design involving more than 25,000 compromised IoT devices to conceal attack origins and enable proxy services and remote command execution. The botnet exploits CVE-2023-20118 to compromise IoT devices, facilitating anonymized and encrypted communications via SOCKS5 and Trojan protocols. Despite no known active exploits in the wild, the infrastructure poses a medium severity risk due to its potential for stealthy persistence, evasion, and large-scale disruptive attacks such as DDoS. The use of suspicious certificates and reverse-connect proxies complicates detection and mitigation efforts. The threat primarily impacts IoT ecosystems globally, with a focus on European organizations.

KEVMalware#proxy#infrastructureGermany+6

Mirai, a notorious botnet targeting IoT devices, has evolved since its 2016 debut. Initially known for massive DDoS attacks, newer variants employ sophisticated techniques like UPX packing and common network utilities for evasion and adaptability. Modern Mirai samples extend beyond DDoS, focusing on data exfiltration and long-term persistence. The analysis compares a June 2025 variant with the original, highlighting differences in execution, network behavior, and file characteristics. The new variant demonstrates increased stealth, modularity, and versatility, making it a more significant threat in the interconnected device landscape. Prevention strategies include updated antivirus software, avoiding suspicious links, and regular system and network monitoring.

Malware#botnet#iotGermany+6

This report details the analysis of RapperBot, a sophisticated botnet targeting IoT devices, particularly Network Video Recorders (NVRs). The malware exploits vulnerabilities in these devices to create a large-scale DDoS infrastructure. The analysis covers the botnet's infection process, command and control mechanisms, and its evolution over time. Key features include the use of NFS for malware distribution, encrypted DNS TXT records for C2 communication, and a wide range of supported device architectures. The report also discusses recent law enforcement actions against the botnet and provides recommendations for protection against such threats.

Malware#infrastructure#ddosGermany+6

HUMAN's Satori team uncovered and partially disrupted BADBOX 2.0, a complex fraud operation targeting over 1 million low-cost consumer devices worldwide. The scheme involves a backdoor pre-installed on devices or distributed through unofficial app marketplaces, allowing threat actors to conduct various fraudulent activities. These include selling residential proxy services, ad fraud through hidden ads and WebViews, and click fraud. Four main threat actor groups were identified: SalesTracker, MoYu, Lemon, and LongTV. The operation affects Android Open Source Project devices in 222 countries, with Brazil being the most impacted. Disruption efforts involved collaboration with Google and other partners to mitigate the threat's impact.

Campaign#consumer devices#iotGermany+9

A new Go-based Linux botnet named PumaBot has been identified targeting IoT devices, particularly surveillance systems. It brute-forces SSH credentials using lists from a C2 server, then deploys itself and establishes persistence. The malware disguises itself as legitimate system files, creates systemd services, and adds SSH keys for backdoor access. It also includes components for credential theft and system monitoring. The botnet demonstrates sophisticated evasion techniques and aims for long-term access to compromised devices.

Campaign#linux#botnetGermany+9