Dive Brief:
- Security researchers have revised their estimates of the size of Eleven11bot, which has exploited IoT devices for DDoS attacks against telecom, gaming platforms and other industries.
- GreyNoise on Wednesday said the number of compromised devices was less than 5,000 around the globe. However, Nokia Deepfield said Friday that upward of 30,000 devices are actively involved in DDoS activity and has shared its findings with other firms tracking the botnet.
- GreyNoise now says the botnet is a Mirai variant that utilizes a single new exploit targeting HiSilicon-based devices, most of which are running TVT-NVMS-9000 software.
Dive Insight:
Researchers from Nokia Deepfield said they communicated their findings to other researchers and noted the firms have slight variations in how they calculate their Eleven11bot estimates.
“The 30K count is directly derived from attack data, enriched with our active crawling (for which we see the specific device characteristics for every IP on the internet),” Jerome Meyer, a security researcher at Nokia Deepfield, said via email.
The previous estimates of tens of thousands of devices was based on normal HiSilicon device signature traffic being misidentified as botnet activity, according to GreyNoise.
GreyNoise analyzed a list of about 1,400 IPs provided by researchers at Censys, according to the blog post. GreyNoise said 1,042 were engaged in exploitation and scanning. Researchers said these were primarily connected to embedded systems that are usually not involved in outbound internet communications.
GreyNoise based its revised estimates in part on a May 2024 security advisory about a critical vulnerability in NVMS9000. The company said its revised estimates are based on figures for deployed hardware but conceded the actual totals could be higher.
