SC-116: IoT Botnet Command & Control¶

Executive Summary¶

SWARM PROTOCOL is a derivative of the Mirai family, reflecting evolutionary improvements seen across post-2016 IoT botnets. The malware exploits default or weak credentials on internet-exposed Telnet, SSH, and vendor-specific TR-069 / ONVIF / RTSP services. No memory corruption. No zero-days. Just the ongoing failure of the IoT industry to ship secure defaults.

Once infected, devices join a tiered C2 infrastructure:

• Tier 1 (bots) -- infected IoT devices.
• Tier 2 (middle tier) -- compromised VPS nodes, rotated weekly.
• Tier 3 (operator) -- hidden service, accessed via multi-hop.

The operator sold DDoS capacity on closed forums at rates of $25/hour to $400/day. Between 2025-10-02 and 2026-04-01, 41 attacks were delivered against targets including gaming services, small e-commerce sites, and two journalist publications in authoritarian jurisdictions.

Environment¶

ATT&CK Mapping¶

Timeline¶

Phase 1 -- Seeding (2025-09-15 to 2025-09-30)¶

• 2025-09-15 -- Operator compiles SWARM PROTOCOL variant. Targets 146 vendor-default credential tuples (admin/admin, root/vizxv, etc.).
• 2025-09-17 -- Initial seed infection from 3 VPS scanners (198.51.100.77, 198.51.100.82, 198.51.100.91) against random /16 slices of the IPv4 internet.
• 2025-09-20 -- First 12,000 devices recruited. Scan rate per bot: 120 IPs/second on port 23, 2323, 22.
• 2025-09-30 -- Bot count crosses 48,000. Tier 2 infrastructure upgraded.

Phase 2 -- Exponential Growth (2025-10-01 to 2025-12-10)¶

Phase 3 -- Monetization (2025-10-02 to 2026-04-01)¶

41 paid attacks were delivered during this window. Representative examples:

Phase 4 -- Collateral ISP Brownout (2026-01-19)¶

• 2026-01-19 14:02 UTC -- SP-024 attack directed at target in regional-isp.example.net customer space.
• 2026-01-19 14:07 UTC -- Upstream transit link saturates at 880 Gbps. ISP emergency routing fails to scrub in time.
• 2026-01-19 14:12 UTC -- 412,000 residential customers experience packet loss exceeding 40%.
• 2026-01-19 17:24 UTC -- Full service restored after BGP blackhole coordination with Tier 1 providers.

Phase 5 -- Takedown (2026-04-01)¶

• 2026-03-15 -- Academic honeypot network at research.university.example correlates infection pattern with specific C2 domain rotation.
• 2026-03-22 -- International LEA joint operation obtains Tier 2 VPS seizure warrants across 4 jurisdictions.
• 2026-04-01 06:00 UTC -- Simultaneous seizure of 17 Tier 2 nodes, Tier 3 operator identified via VPS payment trail.
• 2026-04-01 09:00 UTC -- Sinkhole activated for remaining bots. Operator arrested.

Detection Queries¶

KQL -- Outbound scanning from enterprise IoT VLAN¶

NetworkFlow
| where TimeGenerated > ago(24h)
| where SrcSubnet in ("10.34.50.0/24", "10.34.51.0/24")  // IoT VLANs
| where DstPort in (23, 2323, 22, 7547, 5555, 37215, 8080)
| summarize ScanTargets = dcount(DstIp),
            FlowCount = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
        by SrcIp, DstPort
| where ScanTargets > 50
| order by ScanTargets desc

KQL -- IoT device contacting known botnet C2 domain patterns¶

DnsQueryLog
| where TimeGenerated > ago(7d)
| where ClientSubnet startswith "10.34.50"
| extend DomainLength = strlen(QueryName)
| extend DigitRatio = todouble(countof(QueryName, @"[0-9]")) / DomainLength
| where DigitRatio > 0.4 or DomainLength > 30
| summarize UniqueClients = dcount(ClientIp),
            Queries = count(),
            Domains = make_set(QueryName, 10)
        by bin(TimeGenerated, 1h)
| where UniqueClients > 5 or Queries > 100
| order by TimeGenerated desc

SPL -- Massive short-lived outbound UDP flood indicator¶

index=netflow
| bin _time span=1m
| stats sum(bytes_out) as bytes_per_min
        dc(dest_ip) as unique_dests
        values(dest_port) as dest_ports
    by src_ip _time
| where bytes_per_min > 100000000 AND unique_dests > 1000
| eval gbps = round(bytes_per_min * 8 / 60 / 1000000000, 2)
| lookup asset_inventory src_ip OUTPUT device_class owner
| where device_class IN ("camera", "dvr", "router", "iot")
| table _time src_ip device_class owner gbps unique_dests dest_ports
| sort - gbps

SPL -- Default credential success on Telnet/SSH¶

index=network sourcetype="stream:tcp" dest_port IN (23, 2323, 22)
  direction=inbound
| transaction src_ip dest_ip dest_port maxspan=30s
| where eventcount > 1 AND duration < 10
| eval login_success = if(match(_raw, "(?i)(login successful|welcome|#\\s|\\$\\s)"), 1, 0)
| where login_success == 1
| stats count by src_ip dest_ip dest_port
| where count > 3
| lookup threat_intel src_ip OUTPUT threat_category
| table src_ip dest_ip dest_port count threat_category

Indicators of Compromise¶

Network IOCs¶

Host IOCs¶

# Filesystem
/tmp/.swarm
/var/run/.swarm.pid
/etc/rc.local (appended line)

# Process
Process name: [kworker/0:1]  (kernel thread impersonation)
Parent: init (PID 1)

# Synthetic binary hash (SHA-256)
a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

Credential IOCs¶

Common default credential tuples abused (sample):

Behavioral IOCs¶

• Outbound scanning to port 23/2323/22 from device classes that should never initiate outbound.
• DNS requests to algorithmically-generated domain names from IoT subnets.
• CPU usage near 100% on IP cameras that are otherwise idle.
• Device reboot clears infection (non-persistent variant) -- reinfection typically within 10 minutes.

Containment and Eradication¶

At the enterprise¶

1. Network segmentation. IoT devices on isolated VLAN, egress-filtered, unable to initiate outbound to arbitrary destinations.
2. Device inventory. Enumerate every internet-exposed or semi-exposed device. Change default credentials. Disable Telnet.
3. Firmware patching. Prioritize devices with public vendor patches for known exploits (TR-069, ONVIF).
4. Reboot cadence. For non-persistent variants, scheduled reboot can disrupt infection.

At the ISP¶

1. BCP 38 enforcement. Source-address validation at CPE to prevent spoofed reflection.
2. Customer notification. DHCP-level captive-portal steering for infected customers.
3. Port 23 outbound blocking as a default policy for residential subscribers, with opt-out.

At the device level (regulation/industry)¶

1. Unique per-device default credentials (UK PSTI, EU RED, US Cyber Trust Mark).
2. Mandatory secure-by-default disabling of Telnet.
3. Automatic security updates.

Lessons Learned¶

Recommendations¶

1. Egress default-deny for IoT. Segment, allowlist, inspect.
2. IoT asset inventory is a baseline control. You cannot defend what you have not counted.
3. DDoS runbook with ISP coordination pre-established. Do not build the relationship during the incident.
4. Advocate for regulatory minimums. Participate in industry coalitions promoting secure-by-default.
5. Assume defaults. During procurement, budget for credential rotation and Telnet disabling as standard onboarding steps.

Cross-References¶

• Ch34 -- Mobile and IoT Security
• Ch21 -- OT/ICS/SCADA Security
• Ch48 -- Exploit Development Concepts
• Ch31 -- Network Security Architecture -- segmentation patterns
• SC-096 -- Industrial PLC Attack
• SC-101 -- Firmware Supply Chain
• SC-106 -- ICS Water Treatment

Purple Team Exercise Hook¶

Recommended linked exercise: PT-204 "IoT Egress Hunt" -- blue team has 4 hours to enumerate every outbound-capable IoT device and verify egress policy. Red team operates a honeypot C2 and measures which devices successfully phone home.

Scenario classification: Educational -- synthetic botnet. All names, IPs, device classes, and credentials are synthetic per Nexus SecOps safety rules.