2024 IoT malware trends: Navigating the evolving landscape of cyber threats

Botnets (networks of infected IoT devices) have become a primary tool for conducting Distributed Denial of Service (DDoS) attacks. These attacks overwhelm target systems with traffic, causing service disruptions. In 2023, the complexity and frequency of such attacks intensified, with botnets growing larger and more powerful. The Mirai botnet, for instance, continues to be notorious for exploiting weak security in IoT devices. By commandeering a vast array of devices, from home routers to security cameras, attackers orchestrate large-scale, coordinated assaults on critical web infrastructure.

Attackers traditionally used ransomware to target computers and servers, however, in recent years it has expanded its reach to IoT devices. This form of malware encrypts data on infected devices, rendering them unusable until a ransom is paid. The implications are particularly alarming for IoT devices as they are often integral to the monitoring and management of physical systems. For example, an attack on industrial IoT devices could halt production lines or disrupt utility services, leading to significant economic and operational consequences.

Although most IoT devices have limited processing power, this hasn’t deterred cybercriminals from hijacking them to mine cryptocurrency. Whilst a single IoT device usually offers very little power, a large network of compromised devices can collectively contribute the substantial computational power required to enable cryptocurrency mining. This unauthorised use not only compromises the security of the devices but also leads to performance degradation and increased energy consumption.

DNS hijacking has become a prevalent method used by attackers for redirecting internet traffic to malicious sites. By altering DNS settings on IoT devices such as routers, attackers can reroute traffic without authorised users’ knowledge or consent. This allows them to steal sensitive information, distribute malware, or conduct phishing attacks. The subtlety of DNS hijacking makes it particularly insidious, as users may not immediately realise their traffic is being redirected.

One of the more sophisticated IoT threats harnessed by attackers is the use of infected devices as proxy servers, termed ‘proxy bots’. This tactic involves using IoT devices to anonymously route malicious traffic, complicating efforts to trace and neutralise cyber threats. Proxy bots can be used for various nefarious activities, including anonymising the source of cyberattacks, distributing malware, or carrying out credential-stuffing attacks. The rise of proxy bots demonstrates the versatility of IoT malware, highlighting the adaptability of cybercriminals and the increasing complexity of threats in the IoT ecosystem.

The global nature of IoT and cyber threats necessitates the development of international cybersecurity standards and regulations. Governments and international organisations must collaborate to establish comprehensive guidelines addressing the unique challenges IoT devices pose. This includes ensuring the security of cross-border data flows and harmonising regulations to facilitate international cooperation in cyber defence.

As the amount of data we collect using IoT devices increases, the number of privacy concerns we have increases exponentially. Regulations such as the General Data Protection Regulation (GDPR) in the European Union set a precedent for how personal data should be handled. Still, these regulations need ongoing adaptation to address the evolving nature of IoT technologies and the data they collect.