The Internet of Vulnerable Things
Summary: Cisco Talos describes finding hard-coded credentials in Trane thermostats that would have let a threat actor log in remotely and take full control of the devices, and says it withheld disclosure until the vendor released a patch. Talos also cites the Mirai botnet's record denial-of-service attack on Twitter, PayPal and Spotify, compromised CCTV digital video recorders mining bitcoins, and researchers spoofing traffic data to fake a traffic jam.
Why it matters: An insecure IoT device on a corporate network is another computer offering a point of ingress, and unlike most networked machines it is unlikely to have anti-virus or security software, so an attacker can lurk there for extended periods with little risk of discovery.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026