IoT Reaper 'will be worse than Mirai'
Researchers discover botnet that enslaves devices with unpatched flaws

A botnet that has the potential to be worse than Mirai is "actively expanding" across millions of vulnerable IoT devices, researchers have warned.
IoT Reaper has taken over tens of thousands of web-connected devices so far, and it has identified millions more to infect with a malicious code, researchers at 360 Netlab revealed on Friday.
While Reaper shares some of its code with Mirai, the botnet that last year cut access to some of the world's biggest sites, like Twitter, before being open sourced, the researchers who discovered it believe it is far more dangerous than its relative.
Mirai hijacked devices by cracking those using default or weak passwords, but Reaper targets devices with unpatched vulnerabilities.
Netlab's team spotted nine existing IoT flaws integrated into Reaper's malware, affecting manufacturers like Linksys, AVTech, and Netgear.
"Note just in the last 10 days, the attacker has continuously added more new exploits into samples, one of which is [sic] adopted only 2 days after the disclosure of the vulnerability was made," the team wrote in a blog post.
One Reaper command and control server has managed to control 20,000 devices in the week before Netlab revealed the botnet, and another controlled 10,000 in a single day. More than two million are queued up for infection by another command and control server.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Netlab's researchers said: "We have not seen actual DDoS attack so far. The only instructions we saw are to download samples. This means the attacker is still focusing on spreading the botnets."
"To stop the propagation of this botnet, all companies and consumers should ensure all their devices are running the latest firmware versions, which will have security patches included," said Tristan Liverpool, direcor of systems engineering at F5 Networks.
"However, as the Reaper botnet already has many devices under its control ... everyone needs to prepare for the worst, as it is still unknown whether the motive of the perpetrators is chaos, financial gain or to target specific states or brands."
Picture: Bigstock
-
M&S suspends online sales as 'cyber incident' continues
News Marks & Spencer (M&S) has informed customers that all online and app sales have been suspended as the high street retailer battles a ‘cyber incident’.
By Ross Kelly
-
Manners cost nothing, unless you’re using ChatGPT
Opinion Polite users are costing OpenAI millions of dollars each year – but Ps and Qs are a small dent in what ChatGPT could cost the planet
By Ross Kelly
-
UK crime fighters wrangle “several thousand” potential cyber criminals in DDoS-for-hire honeypot
News The sting follows a recent crackdown on DDoS-for-hire services globally
By Ross Kelly
-
US begins seizure of 48 DDoS-for-hire services following global investigation
News Six people have been arrested who allegedly oversaw computer attacks launched using booters
By Zach Marzouk
-
Will triple extortion ransomware truly take off?
In-depth Operators are now launching attacks with three extortion layers, but there are limitations to this model
By Connor Jones
-
GoDaddy web hosting review
Reviews GoDaddy web hosting is backed by competitive prices and a beginner-friendly dashboard, and while popular, beware of hidden prices
By Daniel Blechynden
-
Japan investigates potential Russian Killnet cyber attacks
News The hacker group has said it’s revolting against the country’s militarism and that it’s “kicking the samurai”
By Zach Marzouk
-
LockBit hacking group to be 'more aggressive' after falling victim to large-scale DDoS attack
News The ransomware group is currently embroiled in a battle after it leaked data belonging to cyber security company Entrust
By Connor Jones
-
Record for the largest ever HTTPS DDoS attack smashed once again
News The DDoS attack lasted 69 minutes and surpassed the previous record of 26 million RPS
By Praharsha Anand
-
Cloudflare mitigates biggest ever HTTPS DDoS attack
News A botnet generated over 212 million HTTPS requests from over 1,500 networks in 121 countries
By Zach Marzouk