TL;DR: Federal authorities dismantled four botnets that controlled more than three million compromised IoT devices, and Sprocket Security argues the real failure is defensive, not technical: organisations inventory owned endpoints while attackers target exposed routers, cameras, and NVRs at internet scale. The implication is that asset visibility, segmentation, and detection assumptions must be rebuilt around how attackers actually scan and weaponise shadow IoT.
At a glance
What this is: Four botnets controlling more than three million IoT devices showed how exposed consumer and enterprise IoT assets become large-scale attack infrastructure.
Why it matters: For identity and security teams, this matters because weak device discovery, default credentials, and over-trusted network paths can turn unmanaged IoT into a persistent access and amplification problem.
👉 Read Sprocket Security's analysis of how IoT botnets exploit unmanaged devices
Context
IoT security failures are often governance failures first. Organisations tend to inventory what they purchased, then assume network segmentation and standard monitoring will contain anything outside that list. The article argues that attackers do not respect procurement records, and that mismatch is what lets exposed routers, cameras, and recorders become botnet infrastructure.
The primary issue is not sophisticated malware but unmanaged exposure, weak credentials, and devices that are designed to bridge network paths. That creates an identity-adjacent control problem as well, because default credentials, remote access functions, and cloud-linked management channels all widen the attack surface beyond traditional endpoint thinking.
Key questions
Q: What breaks when IoT devices are not included in asset inventories?
A: Teams lose visibility into the devices attackers actually scan and compromise, which means exposed cameras, routers, and recorders can become infrastructure without ever appearing in formal records. The result is delayed remediation, weak accountability, and blind spots in segmentation and monitoring.
Q: Why do IoT devices make segmentation less effective than teams expect?
A: IoT devices are often designed to bridge cloud management, local networking, and remote access functions. When one is compromised, the malware can reuse those legitimate channels for persistence and lateral reach, so the segment contains far less than teams assume.
Q: How do security teams know IoT traffic controls are working?
A: They should be able to show that devices only contact approved destinations, that unexpected DNS behaviour is investigated, and that inter-device communication is limited to explicit operational needs. If routine device chatter hides unreviewed outbound paths, the control is not working.
Q: Who is accountable when a compromised IoT fleet is used to attack other organisations?
A: Accountability sits with the organisation that failed to govern the devices, especially where exposed credentials, unmanaged remote access, and weak segmentation enabled misuse. Regulators and customers will focus on whether the organisation could identify, control, and monitor the affected assets.
Technical breakdown
Why IoT asset inventories miss attacker targets
Traditional asset inventories rely on ownership, procurement, or CMDB records, which work poorly for IoT because many devices are deployed by contractors, embedded in facilities, or auto-configured after installation. Attackers scan for exposed services, firmware signatures, and protocol banners across the full IPv4 space, so their target set is defined by reachability and weakness, not by internal asset classification. That is why consumer routers, cameras, and NVRs become botnet building blocks even when they are absent from formal inventories. Practical implication: discovery must include internet-facing service exposure and unmanaged edge device enumeration, not just registered endpoints.
Practical implication: extend discovery to exposed services and unmanaged edge devices, not just registered endpoints.
How segmentation fails when devices are built to bridge networks
IoT segmentation often assumes a compromised device is trapped inside a VLAN until it can laterally move outward. The article shows why that model is fragile: cameras, routers, and similar devices already maintain cloud links, local management channels, and peer-to-peer connectivity by design. Malware can reuse those legitimate paths for command and control, subnet scanning, and persistence, which means the device does not need to break out of the segment in the usual way. Practical implication: treat network-bridging functionality as an attack path and restrict outbound and inter-device trust aggressively.
Practical implication: treat network-bridging functionality as an attack path and restrict outbound trust aggressively.
Why IoT traffic is hard to baseline and easier to hide in
IoT telemetry is inherently noisy because devices update irregularly, contact multiple cloud services, and generate traffic spikes based on environmental triggers. That makes behaviour-based detection less reliable than it is for servers or managed endpoints with stable communication patterns. Botnets exploit this by distributing activity across millions of devices, so each compromised device contributes just enough traffic to look ordinary. In practice, DNS tunnelling, small-bandwidth egress, and service-mimicking command channels all blend into expected IoT chatter. Practical implication: build detection around protocol abuse, unexpected destinations, and volume anomalies at fleet level rather than individual-device baselines.
Practical implication: detect protocol abuse and unexpected destinations at fleet level, not just per-device anomalies.
Threat narrative
Attacker objective: The attacker wants a large, resilient pool of compromised devices that can be monetised through DDoS, proxying, and repeated infrastructure abuse.
- Entry begins with internet-scanned IoT devices exposing predictable weaknesses such as default credentials, outdated firmware, or vulnerable SDK implementations.
- Escalation occurs when malware gains persistence and reuses legitimate device functions, including cloud links, DNS traffic, and local network bridging paths, to expand reach.
- Impact is achieved when thousands or millions of compromised devices are coordinated into botnets that generate record-breaking DDoS traffic against third parties.
NHI Mgmt Group analysis
Shadow IoT is now an identity and access problem, not just an asset-management blind spot. The article shows that attackers inventory devices by exposure and service fingerprint, while defenders still rely on purchased-asset lists. That means unmanaged routers, cameras, and recorders can carry effective access into environments long before they are formally recognised. Practitioners should treat device discovery, default credential removal, and remote access governance as part of identity control.
Segmentation without trust reduction creates a false sense of containment. IoT devices often exist specifically to communicate across local and cloud boundaries, so a compromised device can abuse legitimate paths rather than break out of a zone. This is the same governance problem seen in other identity-rich environments: standing connectivity becomes standing exposure. Teams should re-evaluate whether VLANs are actually reducing blast radius or just documenting it.
Attackers win when detection is tuned to normalised devices instead of abnormal behaviour. IoT fleets do not produce clean baselines, which makes per-device anomaly models weaker than fleet-level protocol and destination analysis. The practical lesson is that governance must focus on where devices are allowed to talk, not only on what they are allowed to run. Security teams should anchor controls to communication paths and egress intent.
Device credentials and remote management channels deserve the same lifecycle discipline as human and workload identities. Default logins, vendor cloud links, and auto-configured remote access create long-lived trust that botnet operators can repeatedly exploit. In practice, the organisation’s risk is less about one infected camera than about a repeatable pattern of unmanaged credentials and unreviewed device reachability. Practitioners should fold IoT into identity lifecycle, not treat it as a side inventory problem.
What this signals
IoT governance is converging with identity governance because device credentials, cloud-linked management channels, and remote access functions all create durable trust relationships. As fleets grow, teams need controls that answer a simpler question: which devices are allowed to talk, to whom, and under what conditions?
Shadow IoT exposure: the operational risk is not just unknown devices, but unknown trust paths. That means asset discovery, credential hygiene, and egress control now need to be assessed together rather than as separate programme tracks.
For practitioners
- Map shadow IoT exposure across the internet edge Enumerate externally reachable routers, cameras, NVRs, and other embedded devices by service fingerprint, not by CMDB record, and reconcile them against procurement lists.
- Remove default credentials and unmanaged remote access Require unique credentials, disable factory logins, and review auto-forwarded ports, P2P features, and vendor cloud management paths on every deployed device.
- Harden egress and inter-device trust paths Restrict DNS tunnelling opportunities, outbound cloud destinations, and east-west communication that devices do not explicitly need for operation.
- Tune detection for protocol abuse at fleet level Monitor for unexpected DNS patterns, anomalous destination shifts, and coordinated low-bandwidth egress across device populations rather than single-device spikes.
Key takeaways
- The article’s core warning is that organisations inventory ownership while attackers inventory exposure, and that mismatch creates botnet scale.
- Segmentation and baseline detection fail when the device itself is designed to bridge networks and generate irregular traffic.
- The practical response is to govern IoT as a trust and identity surface, with discovery, credential control, and egress limits working together.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001 , Initial Access; TA0003 , Persistence; TA0008 , Lateral Movement; TA0040 , Impact | The article centres on compromise, persistence, lateral use, and DDoS impact. |
| NIST CSF 2.0 | PR.AC-1 | The key failure is unmanaged device access and unclear trust boundaries. |
| NIST SP 800-53 Rev 5 | AC-4 | Information flow enforcement is central to limiting device bridging and egress abuse. |
| CIS Controls v8 | CIS-1 , Inventory and Control of Enterprise Assets | Incomplete asset visibility is the article's first and most obvious control gap. |
Map exposed IoT exposure and botnet activity to ATT&CK stages, then prioritise controls that cut initial access and persistence.
Key terms
- Shadow IoT: Shadow IoT is the set of connected devices that exist or operate outside security oversight. These devices are often unregistered, poorly patched, and unmanaged by a clear owner, which makes them difficult to trust, monitor, or retire safely.
- Network Bridging Function: A device capability that legitimately connects multiple network zones, services, or communication paths. In IoT environments, this can include cloud management, local control, and remote access features that a compromise can reuse for lateral reach or command and control.
- Fleet-Level Monitoring: Fleet-level monitoring is the practice of looking for patterns across a population of assets rather than focusing only on one failed item. It helps teams identify systemic drift, supplier problems, or repeated failure modes that only become obvious when events are correlated at scale.
What's in the full article
Sprocket Security's full article covers the operational detail this post intentionally leaves for the source:
- How the four botnets mapped to specific exposed-device patterns across routers, cameras, and recorders
- Examples of the service fingerprints and protocol behaviours attackers use to find vulnerable IoT assets
- Why DNS tunnelling, P2P management links, and UPnP-style exposure complicate containment in practice
- What the article recommends for attacker's-eye visibility and asset discovery workflows
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and workload identity. It helps security practitioners connect identity controls to the broader access risks that unmanaged devices, services, and automated systems create.
Published by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
