# IoT Botnets and DDoS: Why Your Smart Devices Are Attacking the Internet

> Billions of IoT devices run embedded Linux with default credentials, no auto-update, and permanent internet exposure. They're the raw material of modern DDoS botnets.

- Category: Attack Analysis
- Author: Akarguard Team, Security Engineering
- Published: Sep 13, 2026
- Canonical: https://akarguard.net/blog/iot-botnets-ddos

---

The reason DDoS attacks keep getting larger is sitting in living rooms and server racks all over the world. Consumer IoT — cameras, routers, DVRs, smart plugs — ships with a security model that is, bluntly, broken: default credentials, firmware with known holes, no reliable update path, and a design that prioritises easy setup over safety. The result is a standing population of billions of always-on, internet-facing devices that an attacker can recruit into a botnet within minutes of finding them.

## How a Device Gets Recruited

- Credential scanning: attackers sweep the internet with tools like masscan or zmap for devices exposing Telnet or SSH, then try default logins.
- Exploit scanning: post-Mirai botnets use N-day CVEs — known bugs in specific firmware versions — to take devices that changed their password but never patched.
- Malware drop: once in, a small binary is fetched and the device checks in with a command-and-control server.
- Silent persistence: the device keeps working normally, so the owner has no idea it is now part of an attack army.

## What Modern IoT Botnets Can Do

- Multi-vector attacks: Mirai descendants launch SYN, ACK, UDP, HTTP-flood and GRE-tunnelled attacks on command.
- Sheer scale: hundreds of thousands of bots at 100 Mbps each add up to tens of terabits.
- Geographic spread that makes source-based blocking futile — the traffic comes from everywhere at once.
- Constant churn: infected devices reboot (clearing the malware) and get reinfected, so the botnet cycles nodes continuously.

> **The owner is a victim too** — The person whose camera is attacking a bank did nothing wrong beyond plugging in a cheap device. This is why source-IP blocking is both ineffective and unfair — the addresses in the flood belong to innocent people, not the attacker.

## What You Can Do as a Device Owner

- Change default credentials on every device immediately — this alone defeats the oldest and most common recruitment method.
- Enable automatic firmware updates wherever the device supports them.
- Put IoT devices on a separate VLAN with no direct inbound internet access.
- If your router's admin panel is reachable from the WAN side, close it now.

## What It Means for the Servers Under Attack

For the target, the takeaway is that you cannot block your way out of an IoT botnet by banning addresses — there are too many, they are innocent, and they cycle constantly. The defence is behavioural and upstream: filter the traffic by how it behaves, not where it comes from. Akarguard's reverse-proxy edge does exactly that for the application-layer portion — challenges that automated clients cannot pass, per-IP and per-ASN rate limits, and a hidden origin so the botnet has no direct target — while raw volumetric floods are absorbed upstream at the network. You do not identify the botnet; you make its traffic fail the moment it tries to act like an attack.

---

Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.