Botnet Attacks And IoT: How Your Devices Can Be Weaponised

Learn More

When an IoT device is compromised, the attacker does not always use it to breach the organization that owns it. In many cases, the device is recruited into a botnet — a network of infected machines operated remotely and used to attack other targets entirely.

For organizations, this creates a dual risk. IoT devices can be victims of botnet recruitment, and they can become weapons used against others — generating legal, reputational, and operational consequences that extend well beyond the initial compromise.

Table of Contents

What Is a Botnet?

Why IoT Devices Are Ideal Botnet Targets

How Botnet Recruitment Works

What Compromised IoT Devices Are Used For

The Consequences for Device Owners

Detecting Botnet Activity on IoT Devices

IoT Security Best Practices

What Is a Botnet?

A botnet is a collection of internet-connected devices that have been compromised by malware and placed under the control of a threat actor — known as a botmaster or operator. Each infected device, referred to as a bot or zombie, receives instructions from a command-and-control (C2) infrastructure and executes them without the knowledge of the device owner.

Botnets are used to conduct a range of malicious activities at scale — including distributed denial-of-service (DDoS) attacks, spam and phishing campaigns, credential stuffing, cryptomining, and malware distribution.

The value of a botnet lies in its scale and distribution. A single attacker controlling thousands or millions of devices can generate traffic volumes, attack breadth, and geographic diversity that would be impossible to achieve from a single source — and far harder to block.

Why IoT Devices Are Ideal Botnet Targets

IoT devices have become the preferred building block for modern botnets for reasons that are structural rather than incidental.

They are always on.

Unlike a user’s laptop that is shut down at the end of the working day, most IoT devices operate continuously — providing botnet operators with a reliable, persistent resource.

They are poorly monitored.

IoT devices rarely generate security alerts, are seldom included in endpoint monitoring programs, and in many organizations sit entirely outside the visibility of the security team. Botnet activity on a compromised IoT device can go undetected indefinitely.

They exist in enormous numbers.

The sheer scale of the global IoT device population gives botnet operators access to a vast pool of potential recruits — and the diversity of device types, locations, and network connections makes botnet traffic difficult to filter or attribute.

They are easy to compromise at scale.

Default credentials, unpatched firmware, and exposed management interfaces allow automated tools to identify and compromise vulnerable IoT devices rapidly. Botnet recruitment campaigns can enlist thousands of devices in hours.

They have meaningful network bandwidth.

IoT devices — particularly those in commercial or industrial environments — are connected to high-bandwidth networks. This makes them valuable assets for generating the traffic volumes required for large-scale DDoS attacks.

How Botnet Recruitment Works

Botnet operators use largely automated processes to identify, compromise, and recruit IoT devices.

Scanning tools continuously probe the internet for devices running vulnerable firmware, exposed management interfaces, or default credentials. This activity is persistent and industrialized — running around the clock across the entire internet address space.
Exploitation follows identification. Automated tools attempt login using known default credential lists, exploit documented firmware vulnerabilities, or abuse exposed services to gain access to the device.
Malware installation establishes the bot agent on the compromised device — connecting it to the botnet’s command-and-control infrastructure and making it available for tasking. In many cases, the malware also attempts to prevent other botnet operators from compromising the same device, securing the resource exclusively.
Persistence mechanisms ensure the bot agent survives device reboots — embedding itself in firmware or startup processes to maintain control even if the device is power-cycled.

The entire process, from initial scan to active botnet recruitment, can be completed in minutes for a vulnerable device.

Learn more: The Most Common IoT Vulnerabilities and How Attackers Exploit Them

What Compromised IoT Devices Are Used For

Once recruited, IoT devices can be directed to conduct a range of malicious activities.

Distributed Denial-of-Service (DDoS) attacks remain the most common botnet application. By directing thousands or millions of compromised devices to flood a target with traffic simultaneously, botnet operators can overwhelm web services, network infrastructure, or online platforms — causing significant disruption. IoT-powered DDoS attacks have generated traffic volumes measured in terabits per second — far beyond the capacity of most targets to absorb.
Credential stuffing uses compromised IoT devices to test stolen username and password combinations against online services at scale — exploiting the geographic distribution of the botnet to evade rate-limiting and IP-blocking defenses.
Spam and phishing distribution leverages the botnet’s scale to send malicious emails from a distributed set of IP addresses — making filtering and blocking significantly more difficult.
Cryptomining uses the processing power of compromised devices to mine cryptocurrency on behalf of the botnet operator — consuming device resources and potentially degrading performance, but leaving no obvious visible indicator of compromise.
Proxy services route attacker traffic through compromised IoT devices to obscure the true origin of malicious activity — making attribution more difficult for defenders and investigators.

The Consequences for Device Owners

Organizations whose IoT devices are recruited into botnets face consequences that go beyond the security incident itself.

Network performance degradation from botnet activity — particularly outbound traffic associated with DDoS participation or cryptomining — can affect legitimate network operations and trigger bandwidth overages.

IP reputation damage occurs when the organization’s IP addresses are associated with malicious traffic. This can result in IP blocks, email deliverability issues, and inclusion on threat intelligence blocklists — affecting business operations well after the compromise is resolved.

Regulatory and legal exposure arises in some jurisdictions where organizations may face questions about their duty of care if compromised devices are used to attack third parties — particularly in regulated sectors.

Reputational risk is significant for organizations whose compromised IoT infrastructure is publicly identified as a source of botnet traffic or DDoS attacks.

Detecting Botnet Activity on IoT Devices

Botnet activity on IoT devices often produces detectable behavioral indicators — if the right monitoring is in place.

Unusual outbound traffic — particularly large volumes of traffic to unfamiliar external addresses, or consistent communication with known C2 infrastructure — is a primary indicator of botnet activity.

Unexpected external connections from devices that should only communicate with local systems or specific cloud services indicate potential compromise.

Anomalous resource utilization — elevated CPU or memory usage on devices not engaged in intensive tasks — may indicate cryptomining activity.

Communication on non-standard ports or using protocols inconsistent with the device’s intended function can indicate malware activity.

Detecting these indicators requires continuous, passive network monitoring capable of baselining normal IoT device behavior and alerting on deviations — a capability that traditional IT security tools are not designed to provide in OT and IoT environments.

Learn more: What Is IoT Security? A Beginner’s Guide for Businesses

IoT Security Best Practices

Change default credentials on every IoT device at deployment.
Default credentials are the primary mechanism through which IoT devices are recruited into botnets. This single control eliminates one of the most commonly exploited vulnerabilities at scale.
Disable unnecessary network services.
Reduce the attack surface of each device by closing unused ports and disabling services not required for the device’s intended function.
Monitor outbound IoT traffic.
Botnet activity is primarily outbound — compromised devices communicating with C2 infrastructure or participating in DDoS attacks. Monitoring outbound traffic from IoT network segments is an effective detection mechanism.
Segment IoT devices from critical systems.
Network segmentation limits the ability of compromised IoT devices to affect internal systems, and makes anomalous outbound traffic easier to identify and contain.
Apply firmware updates where operationally feasible.
Many botnet recruitment campaigns exploit known, patched vulnerabilities. Keeping firmware current where possible reduces exposure to automated exploitation.

IT/OT Convergence: Why Connecting Corporate And Operational Networks Creates New Risks

IT OT CONVERGENCENETWORK SEGMENTATION

Learn how IT/OT convergence increases cyber risk, enables lateral movement, and what controls reduce exposure in connected networks safely.

INTERNET OF THINGS

Lateral Movement In IoT Environments: How Attackers Pivot From IT To OT

IOT SECURITYOT SECURITY

How attackers use lateral movement to pivot from IT into IoT and OT environments, and why this threat is so difficult to detect.

INTERNET OF THINGS

What Is A Building Management System (BMS) And Why Does It Need Cybersecurity?

IOT SECURITYOT SECURITY

Learn what a Building Management System (BMS) is, how it works, and why BMS platforms are a growing cybersecurity risk.

This article is part of the Wizard Cyber Learning Hub — an educational resource for cybersecurity professionals and organizations seeking to strengthen their security posture across IT, OT, and IoT environments.