IoT Attack Statistics: Botnet Sizes, Device Exposure and Default Password Rules

Consumer and enterprise IoT devices now power the largest botnets on record, yet most IoT figures in circulation are vendor marketing with no data period or sample. This page gathers IoT attack figures from their primary publishers: the FBI and partner agencies' advisories on the Flax Typhoon-linked botnet and BADBOX 2.0, Cloudflare's DDoS threat report on the Aisuru botnet, the USENIX study of Mirai, Zscaler ThreatLabz IoT malware telemetry and Palo Alto Networks Unit 42's device study, plus the UK's legal ban on universal default passwords. Every figure carries its publisher and data year in the same sentence or table row. It covers routers, cameras, streaming boxes and other connected devices; industrial control systems are covered separately in the OT and ICS Security Statistics Guide. It is for security, network and product teams that need numbers for an IoT inventory, segmentation or procurement decision. Last reviewed: November 2026.

Source note: every figure is quoted from the named publisher's report, advisory or filing listed at the end; survey and vendor telemetry figures are single-source and labelled with their publisher. Confirm against the official text before relying on it.

Key takeaways

• Botnets now count in millions of hosts: Cloudflare estimates the Aisuru botnet at 1 to 4 million infected hosts, behind a record 29.7 Tbps attack in Q3 2025.
• State actors use the same devices: the September 2024 joint advisory describes a Flax Typhoon-linked botnet of about 260,000 routers, cameras, DVRs and NAS devices in June 2024, 47.9% of them in the US.
• Some devices arrive compromised: the FBI warned in June 2025 that BADBOX 2.0 spans millions of streaming boxes, projectors and similar devices, many infected before purchase.
• Old malware families still dominate: Mirai accounts for about 40% of blocked IoT malware transactions and, with Mozi and Gafgyt, about 75% of malicious payloads (Zscaler, June 2024 to May 2025).
• Default passwords are now regulated: the UK PSTI regulations require each connectable product's password to be unique per product or set by the user.

Headline statistics

Statistics by theme

Botnet size and firepower

IoT botnet counts are estimates from the outside: researchers see scanning, command traffic or attack sources, not the full population. Treat each figure as the publisher's estimate for its own vantage point.

Cloudflare mitigated 8.3 million DDoS attacks in Q3 2025, up 15% on the previous quarter, and saw about 14 hyper-volumetric attacks a day. Botnets of this size turn ordinary home devices into a resource for attacks against anyone. See the DDoS Attack Statistics for the wider attack picture and the Botnets Guide for how botnets operate.

Where compromised devices sit

The 2024 advisory gives an unusually detailed breakdown, because the agencies had visibility of the botnet's management database.

The database also listed more than 385,000 unique US victim devices, previously or actively exploited. The agencies list 66 CVEs used to recruit bots, which makes firmware patching and replacing end-of-life routers the most direct defensive lever. Zscaler's telemetry points the same way: the US accounted for about 54% of IoT malware traffic it observed between June 2024 and May 2025, followed by Hong Kong (15%), Germany (6%), India (5%) and China (4%).

Malware families and targeted sectors

• Family concentration: Mirai accounts for roughly 40% of blocked IoT malware transactions; Mozi has overtaken Gafgyt as second; the three together account for roughly 75% of malicious payloads (Zscaler ThreatLabz, June 2024 to May 2025). Mirai's source code was published in 2016, and its variants still lead almost a decade later. See the Mirai and IoT Botnet Families Guide.
• Sectors: manufacturing and transportation each received 20.2% of IoT malware attacks in Zscaler's data, over 40% combined; in its 2024 data manufacturing alone was 36%.
• Supply chain: BADBOX 2.0 devices are infected before sale, at setup through backdoored apps, or through apps from unofficial marketplaces. The FBI notes most infected devices were made in China. This is a procurement problem as much as a patching one.

Device weaknesses

Unit 42's study of 1.2 million IoT devices in US enterprise and healthcare networks (2018 to 2019 data) remains one of the few large primary samples of enterprise IoT. Its age is a caveat, but the underlying weaknesses have not been displaced by newer published samples.

Unencrypted traffic means credentials and data cross the network in clear text, so anyone on the same segment can read them. Unsupported operating systems mean known flaws stay open for good. Both findings argue for network-level controls, segmentation and monitoring, because many of these devices cannot be fixed on the device itself.

Default credentials

Mirai spread by logging in to devices with factory default usernames and passwords over Telnet, and its success at about 600,000 devices is why default credentials became a regulatory issue. Few publishers give a current, primary figure for the share of IoT compromises that start with a default password, so be wary of any number quoted without a sample and period. The legal position is clearer than the statistics:

The same principle appears in ETSI EN 303 645 provision 5.1. See the UK PSTI Act Guide and the ETSI EN 303 645 Consumer IoT Guide. The Verkada camera breach shows the enterprise version of the problem: admin credentials stored on an internet-facing support server gave access to up to 4,530 cameras at 68 organisations. The lessons are collected in the Default Credential Breaches Lessons Guide.

What the numbers mean for defenders

Small organisations and home offices get most value from replacing end-of-life routers, turning on automatic firmware updates, changing every default password and keeping cameras and smart devices on a separate network. Large organisations need an IoT inventory fed by network discovery, segmentation by device class, and procurement rules that require unique credentials and a published support period. The Enterprise IoT Security Programme Guide covers the rollout.

Where identity fits

Every IoT device is a non-human identity with credentials: a default password, a cloud API key, a device certificate. Botnets succeed where those credentials are shared, guessable or never rotated. Unique per-device credentials, ideally certificates bound to hardware, remove the cheapest route in. See the Device and IoT Identity Guide.

Metrics to track internally

• Inventory coverage: share of IoT devices seen on the network that are in the asset inventory with an owner.
• Default credential rate: share of devices still accepting vendor default credentials, from authenticated scans.
• End-of-life share: devices past the manufacturer's support period.
• Firmware currency: share of devices on the latest vendor firmware, and median days behind.
• Segmentation coverage: share of IoT devices on isolated network segments with egress rules.
• Anomalous egress alerts: IoT devices contacting new external hosts or sending unusual volumes, per month.

Common failure patterns when using IoT statistics

• Treating botnet size estimates as counts: Cloudflare's 1 to 4 million range and the FBI's "millions" are estimates; quote the range.
• Mixing IoT with OT: industrial control figures measure different devices and attackers; keep them separate.
• Quoting old samples as current: Unit 42's figures are from 2018 to 2019; state the period.
• Using vendor telemetry as a market share: Zscaler's country and family shares describe traffic its platform blocked.
• Inventing a default password percentage: few primary sources measure it; cite the law and your own scans instead.
• Citing roundup pages: secondary statistics sites often drop period and sample. Cite the publisher.

Choosing the right source

Questions to ask device suppliers

The figures above translate into a short set of procurement questions that any organisation can ask before buying cameras, routers, displays or building systems:

1. Is each device shipped with a password unique to that device, or does it force the user to set one at first use, as the UK PSTI regulations require?
2. How long will the device receive security updates, and is that period published?
3. How are firmware updates delivered and authenticated, and can they be applied automatically?
4. Does the device need inbound internet access or a vendor cloud service, and can it work with outbound-only rules?
5. Which apps or app stores does it rely on, and can unofficial stores be disabled?
6. Does the device support per-device certificates or other unique credentials for cloud connection?

A supplier that cannot answer the first two questions is selling the kind of device that ends up in the botnets counted on this page.

Methodology notes and caveats

• Joint advisory (September 2024): based on law enforcement visibility of the botnet's management database; record counts are not necessarily unique devices.
• FBI PSA (June 2025): no exact device count published.
• Cloudflare: attacks mitigated on Cloudflare's network; botnet size is an estimate.
• USENIX Mirai study: seven-month retrospective using network telescope and other measurements.
• Zscaler: transactions blocked on its platform, June 2024 to May 2025.
• Unit 42: 1.2 million devices in US enterprise and healthcare networks, 2018 to 2019.

Practitioner checklist

• Cite each figure with publisher, report name and data period in the same sentence.
• Build an IoT inventory from network discovery and assign owners.
• Scan for default credentials and change or disable them before go-live.
• Replace routers, cameras and NAS devices past their support period.
• Put IoT on separate segments with restrictive egress rules.
• Require unique per-device credentials and a stated support period in procurement.
• Block uncertified streaming boxes and unofficial app stores on corporate networks.
• Recheck these figures after each Cloudflare quarterly report and major advisory.

Standards and references

• FBI, NSA and partners: People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations
• FBI IC3: Home Internet Connected Devices Facilitate Criminal Activity (BADBOX 2.0)
• UK Government: Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, Schedule 1
• Cloudflare: DDoS threat report for 2025 Q3
• USENIX: Understanding the Mirai Botnet
• Zscaler ThreatLabz: Mobile, IoT and OT threat findings 2025
• Palo Alto Networks Unit 42: 2020 IoT Threat Report

Related NHI Mgmt Group resources: IoT Security Guide · Mirai and IoT Botnet Families Guide · OT and ICS Security Statistics Guide · DDoS Attack Statistics