IoTroop Botnet - Reaper of the Internet

IoTroop Botnet - Reaper of the Internet

The spiritual successor to the Mirai botnet is now looming inside millions of IoT devices. Will it wreak havoc on the Internet, or can we stop it in its tracks?

Remember Mirai? I don’t blame you if you can’t. A lot has happened since that day in October 2016 when much of the internet crashed as Mirai took down swaths of web servers residing on the East Coast of the United States. Since then, we’ve had WannaCry, NotPetya and the Equifax breach occupy the news and it seems like cyber attacks are becoming common place.

Damage Caused By The Mirai Botnet

Ultimately, Mirai crashed much of the internet by creating a botnet out of Linux IoT devices with little or no password protection, such as unprotected IP Cameras and home routers. Each of these devices was then used as a bot to request small amounts of bandwidth from target websites. Mirai ultimately enlisted over 100,000 devices causing the normal traffic load on target servers to exceed capacity by 10 to 20 times and creating the largest DDoS attack ever seen.

Related Article: CCleaner Supply Chain Attack Exposes Millions Of Windows Users

This DDoS attack started by going after KrebsOnSecurity, a website created by cyber security journalist, Brian Krebs. His web servers received botnet traffic as a high as 620 Gbps. Other websites saw traffic to their websites go as high as 1 Tbps. The botnet took a particular aim at Dyn, a DNS service based in New Hampshire, in the end effecting PayPal, Reddit, Netflix, Twitter, and many more popular services. 

IoTroop or Reaper Looming On The Horizon

Well, it turns out there is another botnet possibly based on Mirai that is lying dormant and may take a death grip on the Web the likes of which we’ve never seen before. This version of the botnet is called Reaper or IoTroop, and the name is fitting. This botnet is enlisting some 10,000 IoT devices a day as bots and may just give the challenge of taking down the whole internet a run for its money.

What’s interesting is we know about it before it has been unleashed, unlike Mirai. Checkpoint Research, an Israeli security firm posted about the growing botnet last week. Checkpoint Research goes into detail about the worm building this botnet, which you can read about here.

In a nutshell, this worm spreads from device to device using known exploits in devices and already resides in millions of devices. IoTroop is different than Mirai in that this isn’t a case of poor and default passwords protecting devices. 

Below is a full list of effected devices from Checkpoint Research:


Protection Name


Wireless IP Camera (P2P) WIFICAM Cameras Information Disclosure

Wireless IP Camera (P2P) WIFICAM Cameras Remote Code Execution


D-Link 850L Router Remote Code Execution

D-Link DIR800 Series Router Remote Code Execution

D-Link DIR800 Series Router Information Disclosure

D-Link 850L Router Remote Unauthenticated Information Disclosure

D-Link 850L Router Cookie Overflow Remote Code Execution

Dlink IP Camera Video Stream Authentication Bypass – Ver2

Dlink IP Camera Luminance Information Disclosure – Ver2

D-Link DIR-600/300 Router Unauthenticated Remote Command Execution

Dlink IP Camera Authenticated Arbitrary Command Execution – Ver2


TP-Link Wireless Lite N Access Point Directory Traversal

TP-LINK WR1043N Multiple Cross-Site Request Forgery


Netgear DGN Unauthenticated Command Execution

Netgear ReadyNAS Remote Command Execution


Netgear DGN2200 dnslookup.cgi Command Injection

Netgear ProSAFE NMS300 Arbitrary File Upload

NETGEAR Routers Authentication Bypass

NETGEAR ReadyNAS np_handler Code Execution

Netgear R7000 and R6400 cgi-bin Command Injection


AVTECH Devices Multiple Vulnerabilities


MikroTik RouterOS SNMP Security Bypass

MikroTik RouterOS Admin Password Change

Mikrotik Router Remote Denial Of Service


Belkin Linksys WRT110 Remote Command Execution – Ver2

Linksys WRH54G HTTP Management Interface DoS Code Execution – Ver2

Belkin Linksys WRT110 Remote Command Execution

Belkin Linksys Multiple Products Directory Traversal

Belkin Linksys E1500/E2500 Remote Command Execution

Cisco Linksys PlayerPT ActiveX Control Buffer Overflow

Cisco Linksys PlayerPT ActiveX Control SetSource sURL Argument Buffer Overflow


Synology DiskStation Manager SLICEUPLOAD Code Execution


Linux System Files Information Disclosure

Can We Stop IoTroop Or Is It Too Late?

Security researches have caught this botnet in its tracks, so there may be time to stop it before it attacks. A good way to think of these botnets is like a ticking time bomb. If you find the bomb in time, experts have a chance to dismantle it. If it goes unnoticed however, you can expect a messy day for the Internet some time in the future.

It isn’t like these botnets just cause issues with services we use for entertainment and social media. Our world is so wired into web services, that when these web services get taken down en masse, it can cause issues with critical infrastructure, such as the electrical grid, hospitals, etc. 

What you can do now is make sure you patch all your IoT devices and routers. It also appears that simply changing your password on any home-based IoT devices (routers, IP cameras, etc.) will defeat the bot on infected devices. It won’t harm you personally or your hardware, but it will have larger implications if Reaper isn’t thwarted.

Related Posts

Comments are disabled in preview mode.
Loading animation