IoT botnets expose a broken asset and segmentation model

At a glance

What this is: This is an analysis of IoT botnets and why security teams miss the devices attackers actually weaponise, with the key finding that inventory and segmentation models lag behind attacker scanning and pivoting methods.

Why it matters: It matters because unmanaged IoT becomes part of the attack surface, the botnet base, and the lateral movement fabric, which affects network security, asset governance, and identity-adjacent controls around device access.

Context

IoT security fails when organisations treat connected devices as peripheral to core security governance. Attackers do not need purchase records or CMDB accuracy to find routers, cameras, and network video recorders, and they often exploit them before defenders even know they exist.

The identity angle is indirect but real: many of these devices authenticate through default credentials, exposed remote access paths, or cloud-linked management channels that behave like unmanaged non-human identities. When those controls are weak, the device itself becomes a persistent access path and a pivot point.

The article’s starting position is typical for modern IoT environments: defenders inventory what they own, while attackers target what is exposed. That mismatch is now a structural governance problem rather than a niche operational blind spot.

Key questions

Q: What breaks when IoT devices are not included in asset inventories?

A: Teams lose visibility into the devices attackers actually scan and compromise, which means exposed cameras, routers, and recorders can become infrastructure without ever appearing in formal records. The result is delayed remediation, weak accountability, and blind spots in segmentation and monitoring.

Q: Why do IoT devices make segmentation less effective than teams expect?

A: IoT devices are often designed to bridge cloud management, local networking, and remote access functions. When one is compromised, the malware can reuse those legitimate channels for persistence and lateral reach, so the segment contains far less than teams assume.

Q: What are the signs that IoT behavioural detection is missing malicious activity?

A: The strongest warning sign is heavy reliance on traffic baselines when the device population has no stable normal. Cameras, routers, and other embedded devices produce variable traffic by nature, so small increments of malicious activity can blend in. If your detections rarely flag IoT and the environment still has exposed devices, the model is probably too weak.

Q: How should organisations govern IoT devices as part of identity security?

A: Treat IoT devices as governed identities, not just endpoints. Assign each device a unique identity, bind onboarding to certificate-based authentication, define revocation criteria, and track which service chains depend on that identity. The governance goal is to make device trust explicit, reviewable, and removable when the device is retired, compromised, or no longer authorised.

Technical breakdown

Why asset inventories miss shadow IoT

Traditional asset discovery starts from procurement, known subnets, or managed endpoints. That works for servers and laptops, but IoT devices often arrive through contractors, facility teams, or consumer-style deployment paths that bypass central registration. Attackers do not care whether a device is in the CMDB. They scan for service banners, exposed management ports, default credentials, and vulnerable firmware signatures such as insecure SDK implementations. In practice, the defender’s inventory is a business record, while the attacker’s inventory is an exposure map built from the public IPv4 space.

Practical implication: build discovery around externally visible exposure, not just owned-device records.

How segmentation fails when devices are built to bridge networks

Segmentation assumes compromise must cross a boundary to create impact. Many IoT devices already straddle boundaries by design, because they maintain cloud connections, local management links, P2P access, and service protocols such as ARP and SSDP. Once malware lands, it can use those legitimate channels for pivoting and persistence without needing to “break out” in the classic sense. In that model, the device is not contained by the segment. The segment becomes the device’s normal operating path, which the attacker inherits.

Practical implication: treat any device with cross-segment reach as a potential bridge, not a contained endpoint.

Why IoT traffic breaks behavioural detection

Behavioural analytics depend on a stable baseline, but IoT devices rarely have one. Cameras stream variable volumes, routers refresh routes, thermostats talk to changing cloud endpoints, and firmware checks happen at irregular intervals. Botnets exploit that noise by adding small amounts of malicious traffic to legitimate flows or hiding command and control inside common protocols such as DNS. At scale, the attack is large, but the per-device signal is weak. That makes conventional anomaly detection far less reliable than it appears on paper.

Practical implication: augment behaviour analytics with exposure, firmware, and destination-risk signals before relying on network baselines.

Threat narrative

Attacker objective: The attacker wants to convert unmanaged IoT devices into scalable, persistent infrastructure for DDoS, scanning, and network pivoting.

1. Entry occurs through exposed IoT services such as default credentials, outdated firmware, or internet-facing management paths on routers, cameras, and NVRs.
2. Credential or access abuse then turns those devices into enrolled bot nodes that can be commanded remotely and retained through persistence mechanisms such as authorised keys or similar device-level changes.
3. The infected devices are used for coordinated DDoS, local scanning, and pivoting across trusted network paths, expanding the operator’s control footprint without needing traditional enterprise lateral movement.
4. Impact is at internet scale: compromised devices become attack infrastructure for botnets that disrupt third parties and expose the owner to operational and reputational liability.

Breaches seen in the wild

• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
• Carbonato botnet 2026: A botnet puts a Hermes AI agent on exposed Docker hosts to steal AI API keys, SSH keys and tokens, powering the operators' own LLM gateway.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow IoT is an identity governance problem disguised as a network problem. The article shows that the most dangerous devices are often outside procurement-driven inventories but still connected through authentication, cloud management, and remote-access paths. That means lifecycle control, ownership, and offboarding matter as much for devices as they do for human accounts. Practitioners should treat unmanaged IoT as a governance failure, not just an asset-discovery gap.

Segmentation is only effective when the protected asset does not already need to cross trust boundaries. IoT devices are often designed to bridge cloud services, local controllers, and remote access tools, so compromise inherits legitimate communications instead of forcing attacker breakout. This is the kind of environment where Zero Trust assumptions have to be applied to device identity and device communications, not just to user sessions. Practitioners should reassess any segment that contains cross-boundary devices.

Detection based on traffic baselines will keep missing botnet activity until it is paired with exposure-aware controls. When normal device behaviour is variable by design, anomaly-only monitoring becomes noisy and brittle. The article reinforces a named concept we would call device bridge risk: assets that are meant to connect trust zones can become the shortest path for abuse once compromised. Practitioners should govern those devices as access-enabling infrastructure.

Attackers are exploiting the gap between what organisations own and what the internet can see. That gap is where device inventory, remote access, default authentication, and segmentation all converge into one failure mode. Frameworks such as OWASP-NHI and NIST CSF become relevant because they force teams to think about non-human access scope, exposure, and resilience together. Practitioners should close the gap from the outside in, not from the CMDB out.

What this signals

Device bridge risk: IoT becomes dangerous when a device is designed to connect trust zones and then inherits those same channels after compromise. That shifts governance from simple segmentation to ownership, exposure control, and trust-path reduction across the full device lifecycle.

For identity and access teams, the practical lesson is that unmanaged device access behaves like an NHI estate with poor lifecycle discipline. If the organisation cannot account for who or what can reach the device, it cannot assume the device is safely contained.

Security programmes should align IoT controls with externally visible exposure, not with asset lists alone. That means discovery, segmentation, and remote-access governance must be evaluated together, because any one of them can fail while the others still appear healthy.

For practitioners

• Map externally exposed IoT before trusting internal inventories Run internet-facing discovery for routers, cameras, NVRs, and similar devices, then reconcile those findings against procurement and CMDB records. Prioritise anything with public management ports, auto-forwarded access, or unknown ownership.
• Remove default credentials and exposed remote access paths Inventory every device that still relies on factory credentials, shared passwords, or unsolicited remote management features. Disable unnecessary UPnP, P2P, and vendor cloud access where business use does not require them.
• Rebuild segmentation around device communication paths Model how each IoT class talks to cloud platforms, local controllers, and peer devices, then segment on those flows rather than on generic VLAN boundaries. Treat cross-segment reach as a control objective, not an exception.
• Add exposure-aware telemetry to behavioural detection Combine flow analytics with firmware status, destination reputation, and known vulnerability exposure so that anomalous IoT traffic is judged in context. Baselines alone are not enough when the device population is inherently variable.

Key takeaways

• The article’s core warning is that IoT risk is being underestimated because defenders inventory owned assets while attackers target whatever is exposed on the internet.
• Botnets can scale because compromised cameras, routers, and recorders are designed to communicate across trust boundaries, which makes simple segmentation far less reliable than many teams assume.
• The strongest controls are external exposure discovery, removal of unnecessary remote access, and device-aware segmentation that reflects actual communication paths.

Key terms

• Shadow IoT: Shadow IoT is the set of connected devices that exist or operate outside security oversight. These devices are often unregistered, poorly patched, and unmanaged by a clear owner, which makes them difficult to trust, monitor, or retire safely.
• Device Bridge Risk: Device bridge risk is the exposure created when an endpoint is designed to communicate across trust zones and can therefore carry compromise from one zone into another. It is common in IoT systems that link local controllers, cloud services, and remote management channels.
• Internet-Facing Exposure: Internet-facing exposure is the condition where a system, interface, or management plane is reachable from the public internet. In vulnerability management, that exposure sharply increases urgency because scanning, exploitation, and follow-on compromise can begin almost immediately after disclosure.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course, the industry's only accredited NHI security programme, if your programme needs a stronger model for governing non-human access.