A large-scale botnet called Eleven11bot is worrying the cybersecurity community after taking control of more than 30,000 devices to carry out distributed denial-of-service (DDoS) attacks on an unprecedented scale. According to security researchers at Nokia, the botnet mainly exploits surveillance cameras and DVRs from Shenzhen, launching attacks that last for days and disrupt many critical systems.
Although there is no sign yet that Eleven11bot is backed by a nation-state, its impact is considerable. Some attacks have reached 6.5 terabits per second (Tbps), breaking the previous record of 5.6 Tbps set in January of this year.
Eleven11bot Botnet: A Global Network Threat
Experts at the Nokia Deepfield Emergency Response Team first spotted Eleven11bot in late February, when a large number of compromised IP addresses simultaneously launched attacks with enormous volumes of traffic. Unlike typical DDoS attacks that target server resources, Eleven11bot focuses on overwhelming network bandwidth, seriously affecting systems.
The botnet has targeted telecom providers, online game hosting systems, and many other critical infrastructure operators. Some victims were knocked offline for days because they could not withstand the huge volume of data that Eleven11bot generated.
According to Nokia's report, 24.4% of infected devices are located in the United States, making it the most heavily affected country. However, Eleven11bot operates across the globe and could continue to spread.
Jérôme Meyer, a security expert at Nokia, said:
“This botnet is far larger than typical DDoS attacks. The attack intensity ranges from a few hundred thousand to hundreds of millions of packets per second.”
Nokia initially estimated that Eleven11bot had about 30,000 devices participating. However, the Shadowserver Foundation believes the actual figure could be as high as 86,000 devices. By contrast, security firm Greynoise put the number much lower, at only about 5,000 devices, with most of the activity coming from Iran (61%).
Meyer rejected the Shadowserver estimate, arguing that the figure is inflated because of flaws in the method used to identify infected devices. Even so, he maintains that the number of devices actually under the botnet's control is somewhere between 20,000 and 30,000 IPs.
Origins of Eleven11bot and How to Defend Against It
Security researchers believe Eleven11bot is a new variant of Mirai, a notorious piece of malware that first appeared in 2016 and specializes in exploiting Internet of Things (IoT) devices such as security cameras, routers, and DVRs. This botnet can break into devices by exploiting default passwords or unpatched software vulnerabilities.
According to Greynoise, Eleven11bot has exploited a security flaw in the Shenzhen TVT-NVMS 9000 DVR, which uses a HiSilicon chip, to turn these devices into DDoS attack tools.
How to protect your devices from Eleven11bot
Experts recommend the following steps to protect IoT devices from botnet attacks:
- Turn off remote access if it is not truly needed.
- Set strong, unique passwords instead of using the default ones.
- Update firmware regularly to patch security vulnerabilities.
- Use a firewall to restrict unauthorized access.
- Monitor network traffic and watch for unusual signs such as sudden bandwidth spikes.
Botnet attacks are becoming more sophisticated and larger in scale. Protecting IoT devices from botnets such as Eleven11bot is essential to stopping large-scale DDoS attacks and safeguarding network infrastructure and online systems worldwide.
