2023 witnessed an upswing in advertisements on the dark web that promoted Distributed Denial of Service (DDoS) attacks leveraging Internet of Things (IoT) devices, according to a recent report by Kaspersky.

The cost of these services fluctuates based on factors such as DDoS protection and verification measures at the target’s end. The range starts as low as $20 per day and can climb up to $10,000 per month. The mean charge for these services is approximately $63.50 daily or $1,350 monthly.

Additionally, the dark web functions as a nexus for tools that exploit zero-day vulnerabilities in IoT devices. It also offers packages of IoT malware equipped with the necessary infrastructure and software.

When discussing IoT malware, a variety of strains are present, with several having roots tracing back to the notorious 2016 Mirai malware.

A heightened sense of rivalry among cyber-criminals has driven the evolution of tools designed to thwart competing malware. These measures include instituting firewall guidelines, deactivating remote device control, and halting operations linked to opposing malware.

The predominant strategy to compromise IoT devices is still through brute-force assaults on frail passwords. This approach takes precedence over exploiting flaws in network services. Such brute force invasions, largely targeting the unsecured Telnet protocol, empower malicious entities to illicitly penetrate by deciphering passwords. This, in turn, permits them to execute commands and implant malware.

During 2023’s initial six months, Kaspersky’s honeypots observed that a staggering 98% of brute-force password trials zeroed in on Telnet, leaving a meager 2% for SSH. The origins of these attacks were primarily associated with China, India, and the USA. Notably, China, Pakistan, and Russia emerged as the most relentless offenders.

Furthermore, IoT gadgets are susceptible due to the vulnerabilities in the services they utilize. These onslaughts execute malevolent commands by manipulating flaws in IoT web interfaces, leading to grave outcomes, including the dissemination of malware similar to Mirai.

Yaroslav Shmelev, a noted expert from Kaspersky, emphasized the importance of strengthening security measures for both consumer-grade and industrial IoT devices. He highlighted the numerous threats present in the IoT domain, ranging from DDoS onslaughts to ransomware, and security concerns in various smart and industrial gadgets. He further mentioned that Kaspersky’s findings accentuate the significance of a dedicated approach to IoT safeguarding, urging vendors to ramp up product security from the outset and actively defend their clientele.