Notifications
Clear all
Topic starter
18/08/2026 2:52 pm
TL;DR: Federal authorities dismantled four botnets that controlled more than three million compromised IoT devices, and Sprocket Security argues the real failure is defensive, not technical: organisations inventory owned endpoints while attackers target exposed routers, cameras, and NVRs at internet scale. The implication is that asset visibility, segmentation, and detection assumptions must be rebuilt around how attackers actually scan and weaponise shadow IoT.
NHIMG editorial — based on content published by Sprocket Security: Federal authorities dismantled four botnets controlling over three million compromised IoT devices
Questions worth separating out
Q: What breaks when IoT devices are not included in asset inventories?
A: Teams lose visibility into the devices attackers actually scan and compromise, which means exposed cameras, routers, and recorders can become infrastructure without ever appearing in formal records.
Q: Why do IoT devices make segmentation less effective than teams expect?
A: IoT devices are often designed to bridge cloud management, local networking, and remote access functions.
Q: How do security teams know IoT traffic controls are working?
A: They should be able to show that devices only contact approved destinations, that unexpected DNS behaviour is investigated, and that inter-device communication is limited to explicit operational needs.
Practitioner guidance
- Map shadow IoT exposure across the internet edge Enumerate externally reachable routers, cameras, NVRs, and other embedded devices by service fingerprint, not by CMDB record, and reconcile them against procurement lists.
- Remove default credentials and unmanaged remote access Require unique credentials, disable factory logins, and review auto-forwarded ports, P2P features, and vendor cloud management paths on every deployed device.
- Harden egress and inter-device trust paths Restrict DNS tunnelling opportunities, outbound cloud destinations, and east-west communication that devices do not explicitly need for operation.
What's in the full article
Sprocket Security's full article covers the operational detail this post intentionally leaves for the source:
- How the four botnets mapped to specific exposed-device patterns across routers, cameras, and recorders
- Examples of the service fingerprints and protocol behaviours attackers use to find vulnerable IoT assets
- Why DNS tunnelling, P2P management links, and UPnP-style exposure complicate containment in practice
- What the article recommends for attacker's-eye visibility and asset discovery workflows
👉 Read Sprocket Security's analysis of how IoT botnets exploit unmanaged devices →
IoT botnets and segmentation: what IAM teams should notice?
Explore further
18/08/2026 3:36 pm
Shadow IoT is now an identity and access problem, not just an asset-management blind spot. The article shows that attackers inventory devices by exposure and service fingerprint, while defenders still rely on purchased-asset lists. That means unmanaged routers, cameras, and recorders can carry effective access into environments long before they are formally recognised. Practitioners should treat device discovery, default credential removal, and remote access governance as part of identity control.
A question worth separating out:
Q: Who is accountable when a compromised IoT fleet is used to attack other organisations?
A: Accountability sits with the organisation that failed to govern the devices, especially where exposed credentials, unmanaged remote access, and weak segmentation enabled misuse. Regulators and customers will focus on whether the organisation could identify, control, and monitor the affected assets.
👉 Read our full editorial: IoT botnets expose a broken asset and segmentation model
