New DDoS Botnet Discovered: Over 30,000 Hacked Devices, Majority of Observed Activity Traced to Iran
Summary: Nokia Deepfield's Emergency Response Team identified a botnet tracked as Eleven11bot that it estimated has compromised over 30,000 devices, primarily security cameras and NVRs, and has been used in DDoS attacks against telecom providers and gaming platforms, some lasting multiple days. GreyNoise analyzed a list of 1,400 IPs from Censys, found 1,042 hitting its sensors in the past 30 days, and identified 305 IP addresses actively carrying out malicious attacks linked to the botnet.
What's compelling: A researcher described Eleven11bot as one of the largest known DDoS botnet campaigns since February 2022, and the activity rose two days after the U.S. reimposed new economic sanctions on Iran - though GreyNoise states it does not speculate on attribution.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026