In the constantly evolving landscape of cyber threats, a new botnet dubbed Eleven11bot is making waves and it's turning out to be a familiar foe in disguise.
👾What is Eleven11bot?
Eleven11bot was initially spotted as a new distributed denial-of-service (DDoS) botnet targeting a range of systems, including routers, IoT devices, and exposed servers. However, recent research has confirmed that it’s not entirely "new" it’s actually a variant of the notorious Mirai malware.
Mirai, which rose to infamy in 2016 after a series of devastating DDoS attacks (including one that temporarily took down much of the internet on the U.S. East Coast), continues to live on through these evolving strains.
📡How It Works
Eleven11bot infects internet-connected devices by exploiting default credentials and unpatched vulnerabilities. Once compromised, these devices become part of a botnet a vast army of zombie systems that can be remotely controlled to launch massive DDoS attacks.
The malware communicates with a command-and-control (C2) server, which sends instructions to conduct various types of attacks including:
- SYN floods
- UDP floods
- TCP ACK floods
- Application-layer attacks targeting specific services
🎯Who's Being Targeted?
Researchers report that telecommunications providers, gaming platforms, and cloud services are among the primary targets. These industries are particularly vulnerable due to their uptime requirements and massive volumes of daily traffic.
🧬Why This Matters
The discovery of Eleven11bot as a Mirai variant underscores a troubling trend: cybercriminals are recycling old malware with new capabilities. It’s efficient, effective, and hard to detect if defenders are only looking for novel threats.
It also highlights a continued failure to address some basic security hygiene practices:
1.) Default login credentials are still widely used.
2.) Many IoT devices remain unpatched or unpatchable.
3.) Network segmentation and monitoring are often lacking.