Skip to content

Cybersecurity Atlasby Jer Catallo

Cybersecurity Atlas

One reference surface for application, cloud and product security.

API documentation

Find & Respond

AppSec Playbook
Vulnerabilities Atlas

Build & Harden

Hardening Atlas
Security Tooling

Learn the Fundamentals

Security Concepts

Resources

OWASP Top 10
MITRE ATT&CK
NIST Cybersecurity Framework

© 2026 Jer Catallo. Reference material only, always confirm against the official source.

About
API Documentation

IoT Botnet Recruitment incident response playbook · Cybersecurity Atlas

Home
Playbook
IoT Botnet Recruitment

IoT Botnet Recruitment

HighIoT SecurityOWASP IoT Top 10 - I1: Weak, Guessable, or Hardcoded Passwords

Internet-exposed IoT devices with default credentials or unpatched vulnerabilities are compromised at scale and enrolled into botnets used for DDoS attacks, proxying, and further scanning.

Immediate Response

1Isolate infected devices from the network.
2Factory reset devices and reflash with the latest vendor firmware.
3Change all default credentials before reconnecting.
4Block identified command-and-control addresses at the perimeter.

Short-term Remediation

1Move IoT devices to a dedicated segment with deny-by-default egress rules.
2Disable Telnet, UPnP, and remote management on all devices.
3Inventory every connected device and its firmware version.
4Alert on scanning behavior originating from IoT segments.

Long-term Prevention

1Procure devices that support unique credentials, secure boot, and signed updates.
2Establish a firmware patching process with vendor end-of-life tracking.
3Retire devices that no longer receive security updates.
4Monitor IoT traffic with network detection tooling.

Attack vectors

Default or hardcoded Telnet and SSH credentials
Exploitation of known firmware vulnerabilities in routers, cameras, and DVRs
Exposed management interfaces reachable from the internet
UPnP automatically opening ports on edge routers

Indicators of compromise

Devices initiating outbound scans on ports 23, 2323, or 22
Unusual outbound traffic volume from IoT segments
Connections to known botnet command-and-control infrastructure
Devices rebooting frequently or showing modified configuration

Tooling

ShodanNmapZeekSuricata

References

owasp.org/www-project-internet-of-things/
www.cisa.gov/news-events/alerts/2016/10/14/heightened-ddos-threat-posed-mirai-and-other-botnets