Follow the Access · 18 — The IoT Worm: The Self-Spreading Conscription of Everything

Follow the Access — Case 18. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

Case 01 opened this register at a default-password door and followed one machine through it to a miner. This case returns to the same door and follows something that does not stop at one machine: a worm. An IoT worm is self-propagating malware — it does not need an operator to point it at each target, because it points itself. It finds a device with a weak or default credential, infects it, and then, from that newly-infected device, immediately begins scanning the internet for more devices to infect. Every victim it takes becomes a new attacker, hunting for the next victim, which becomes another attacker, and so on. The result is not one intruder hitting many machines but a contagion that recruits every machine it touches into its own attacking force, growing not by addition but by multiplication across the vast, weakly-secured population of the internet of things.

The honeypot beneath these words catches this lineage directly. Among its captured payloads are elf.mirai and elf.bashlite — Mirai and Gafgyt, the two dominant IoT-botnet families — arriving alongside exactly the default-credential brute-forcing (admin:admin, root:root, the factory-default table) by which these worms spread. Mirai, whose source code was published in 2016 and became the template for a decade of successors, conscripted cameras and routers and DVRs by the hundreds of thousands and launched some of the largest denial-of-service attacks then recorded; its descendants — Mozi, BASHLITE, Aisuru, and endless variants — carry the same self-spreading logic forward to this day. The sensor is not reading about the IoT worm in a report; it is watching the worm's spread attempts land at its own door, thousands of times, the same contagion documented across the whole internet arriving to try the honeypot's locks.

So the disposition is PROXIED, and here the case diverges sharply from Case 01. The default-password box of Case 01 was mined — its CPU stolen for cryptocurrency. The IoT worm's conscripted device is rented — its bandwidth and its trusted residential IP address sold as attack infrastructure. As a DDoS bot, it is one gun in a cannon that floods targets off the internet; as a residential proxy, it is a clean-looking home IP address through which someone else launders their traffic. Same door, different operator, different fate: this is the case about the worm that conscripts everything, and the rental market for the army it builds.

1. The Contagion Logic

Begin with what makes a worm categorically different from the attacks the register has mostly followed, because the difference is the whole reason IoT botnets reach the scale they do. Nearly every vector so far has been, at the point of intrusion, one attacker acting against targets — a person or a program reaching out to compromise machines one after another. The attacker's reach is bounded by the attacker's own resources: how many machines he controls to scan from, how much time and bandwidth he has. A worm removes that bound entirely, because the worm does not scan from the attacker's resources; it scans from the victims'.

Here is the loop, and its consequence. The worm lands on a device — say, a camera with a default password. It infects the camera. And then it uses the camera to do what the worm does: scan the internet for more vulnerable devices, and infect them. Now there are two infected devices, both scanning, both infecting. Then four, then eight. Each new victim adds its own bandwidth and its own vantage point to the scanning effort, so the more devices the worm takes, the faster it takes more. This is exponential growth, the mathematics of contagion, and it is why a worm released against a large vulnerable population does not creep — it explodes. Mirai went from nothing to hundreds of thousands of conscripted devices with startling speed precisely because every device it took immediately joined the hunt for the next. The attacker did not have to scale his own operation; the victims scaled it for him, each one drafted, at the moment of its own infection, into the army attacking everyone else.

This is the property that makes the worm's initial release almost incidental to its eventual size. The operator does not need vast resources to start; he needs only to infect a first handful of devices, and the contagion logic does the rest, borrowing the bandwidth and the reach of every machine it conscripts. It also means the worm is, in a sense, autonomous — once released, it spreads without further instruction, finding and infecting new hosts on its own, a self-directed epidemic across the machines of the internet. The register has followed attackers who worked hard to reach many targets; the worm works once and then lets its victims do the reaching. It is the vector that turns the compromised into the compromising, and in doing so achieves a scale that no operator's own resources could ever reach.

2. Why the Internet of Things Is the Perfect Terrain

Now the question of why this worm thrives specifically in the internet of things, because a self-propagating worm needs a population to propagate through, and the IoT population is almost purpose-built to be that reservoir. Five structural properties of cheap internet-connected devices make them the ideal host, and together they explain why the Mirai lineage has persisted for a decade and will persist for many more.

First, they are numerous beyond reckoning — billions of cameras, routers, DVRs, smart-home gadgets, and industrial sensors, a target population so large that even a tiny fraction being vulnerable means millions of infectable hosts. Second, they are weakly secured: built cheaply, they ship with default credentials, run outdated firmware, and expose services like telnet that should have died decades ago — the weak-credential door of Case 01, present across the whole class. Third, they are always on and always connected: a camera or router runs continuously, so an infected one is a continuously-available bot, unlike a personal computer that gets turned off. Fourth, they are unmonitored: no one watches a security camera's CPU or a router's outbound traffic, so an infection produces no noticed symptom, and the device can stay conscripted for years without anyone realizing. And fifth, decisively, they are effectively un-patchable in practice: many IoT devices will never receive a security update in their entire operational lives — the manufacturer shipped them and moved on, the owner does not know how to update them or that they should, and so the vulnerability that let the worm in stays open permanently.

Put these together and the IoT population is a permanent, self-replenishing reservoir of infectable machines that will never be cleaned, never be patched, and never be noticed. This is a catastrophic combination for defense, because it means the worm never runs out of hosts. A worm in a well-managed population would eventually exhaust itself as machines get patched and cleaned faster than it spreads; but in the IoT population, the vulnerable devices are never cleaned and are constantly replenished by new insecure devices being shipped and connected. The reservoir does not drain; it refills. This is why Mirai's descendants are still conscripting devices today, a decade after the original: not because the malware is unstoppable, but because the population it feeds on is inexhaustible and perpetually vulnerable. The internet of things did not just enable the IoT worm; it guaranteed the worm a permanent home.

3. PROXIED — Renting Out the Army

Now the disposition, and it is where this case parts ways with Case 01, because the operator of an IoT botnet monetizes his conscripted devices in a fundamentally different way than the cryptojacker. He does not, in the main, mine them — an IoT device's tiny processor is poor mining hardware. He rents them, for the two things a large population of always-on, residentially-connected devices uniquely provides: bandwidth and trusted IP addresses. The disposition is PROXIED, because both monetizations turn the device into rented infrastructure through which other people's purposes flow.

The first and most famous use is the distributed denial-of-service attack. Any single IoT device has modest bandwidth, but hundreds of thousands of them, commanded to send traffic at a target simultaneously, aggregate into a torrent that overwhelms the target's capacity and knocks it off the internet. This is the botnet as a cannon, and its firepower is sold: "booter" and "stresser" services rent the botnet's aggregate bandwidth by the minute, letting any customer flood any target for a small fee. The market is disturbingly accessible — booters have been used for everything from schoolyard grudges and gaming disputes to serious business sabotage and extortion — and it exists because the IoT worm produces exactly the raw material it needs: a vast pool of bandwidth-bearing devices whose combined output can drown almost anything. The conscripted camera's contribution to any single attack is small, but its bandwidth, rented alongside hundreds of thousands of others, is a share of a weapon.

The second use is quieter and, in some ways, more valuable: the residential proxy. Every IoT device has an IP address, and for home devices, that address is a residential one — the kind assigned to real households by real internet providers. Residential IP addresses are prized by a whole class of actors, because traffic from a residential IP looks legitimate in a way that traffic from a datacenter does not. Websites and services block or scrutinize datacenter IPs (where bots live) but trust residential IPs (where customers live), so anyone who needs their traffic to appear to come from an ordinary home user — ad-fraud operators, scrapers, credential-stuffers, sanctions-evaders, and attackers laundering their origin — will pay to route it through a compromised residential device. The IoT worm's conscripted devices become a residential-proxy network, their trusted home IP addresses rented out to launder other people's traffic through a connection that looks innocent. This is the device PROXIED in the most literal sense: it is a proxy, passing someone else's traffic through its trusted address, so that the real actor hides behind a stranger's home connection. Between the DDoS cannon and the proxy network, the conscripted device's fate is the same — rented out as infrastructure — which is why the register records the disposition as PROXIED: the IoT worm is a factory for attack capacity, and PROXIED is the sale of that capacity to whoever needs to flood a target or hide their tracks.

4. One Door, Two Fates

Pause on the relationship to Case 01, because the two cases share a door and diverge at the disposition, and that divergence illustrates one of the register's deepest recurring lessons: the disposition follows the operator, not the vector. Both cases enter through the same weak-credential door — the default password, the factory-set telnet login, the unhardened IoT device. A scanner sweeps for it; the credential opens it; a machine is compromised. Up to that instant, Case 01 and Case 18 are identical.

Then they diverge, and the divergence is entirely about who is running the operation and what business they are in. In Case 01, the operator is a cryptojacker, and his business is converting stolen compute into Monero, so he installs a miner and the box's fate is MINED. In Case 18, the operator is a botnet herder, and his business is renting attack infrastructure, so he installs a bot and the device's fate is PROXIED — its bandwidth and residential IP sold rather than its CPU mined. The same device, taken through the same door by the same kind of weak credential, ends in a completely different disposition depending only on which operator's worm reached it first. If the cryptojacker's scanner finds the camera, it is mined; if the botnet herder's worm finds it, it is proxied. The door does not determine the fate; the operator does.

This is why the register insists on following the foothold to its disposition rather than stopping at the point of entry — because the point of entry radically underdetermines what happens. Two cases, one door, two fates, and the fate is the thing that matters to the victim and to the world: a mined camera costs its owner some electricity, while a proxied camera might be participating, at this moment, in an attack that knocks a hospital offline or launders a fraudster's traffic. The same trivial security failure — the unchanged default password — feeds two entirely different criminal economies, and which one it feeds is a matter of which operator's automation happened to arrive. The register's structure, closing each case on the disposition, exists precisely to capture this: the door is common and boring, but the fate is specific and consequential, and the IoT worm and the cryptojacker prove that the same open door can lead to a mining rig or an army, depending on who walks through it.

5. The Fix That Must Reach the Factory

The register owes the defense, and the IoT worm presents the same trivial-yet-unapplied fix as Case 01, with an added structural dimension that makes it the register's clearest argument for shifting responsibility from the owner to the manufacturer. The owner-side fix is genuinely simple: change the device's default credentials so the worm's credential table does not open it; disable telnet and any remote access the device does not need; keep firmware updated where updates exist; and — the containment measure — segment IoT devices onto a separate network, so that a compromised camera can talk to the internet but not to anything that matters, and its conscription does not become a foothold into the rest of the home or business. Each of these defeats the worm for that device, and none is hard.

But here the IoT worm exposes a limit that the owner-side fix cannot overcome, and it is a limit of scale. There are billions of these devices, owned by people who do not know they need securing, who do not know how to secure them, who may not even know the devices are internet-connected, and who will never change a default password or apply a firmware update. Telling the owner to secure the device is correct advice that does not scale to the population, because the population is, in large part, unattended and unaware. This is why the IoT worm persists despite a trivial fix: the fix requires action from billions of individuals who will never take it, and the vulnerable population is continuously replenished by new insecure devices shipped every day. No amount of owner education will drain a reservoir that refills faster than it empties.

So the durable answer, the register argues, must reach the factory rather than only the home: manufacturer responsibility for secure-by-design devices. A device that ships without universal default credentials — that forces a unique password at setup, or has no default login at all — cannot be conscripted by a worm's credential table, no matter how inattentive its owner. A device that auto-updates can be patched against the flaws worms exploit without the owner lifting a finger. These are manufacturer decisions, not owner decisions, and the only way to secure the IoT population at scale is to require manufacturers to make them — which is exactly the direction regulation has taken, with secure-by-design initiatives and IoT security laws increasingly mandating no-universal-default-credential and update-capability requirements. The IoT worm is the register's strongest case that some security problems cannot be solved at the endpoint, because the endpoints are too numerous and too unattended to secure individually; they can only be solved upstream, at the point of manufacture, before the insecure device is ever shipped. Change the default password, yes — but the honest recognition is that most defaults will never be changed, so the real fix is to stop shipping devices that have a universal default at all. The worm feeds on a factory output, and the fix must reach the factory.

6. The counter-narrative, steelmanned

The strongest objection to this case is that the IoT worm is low-stakes noise — that a conscripted camera is a trivial loss to its owner, that DDoS is a nuisance rather than a serious crime, and that the register inflates a background hum into a headline vector.

The argument runs like this. The individual victim of an IoT-worm conscription loses almost nothing — a sliver of a camera's bandwidth, unnoticed and immaterial — so there is no real harm to the device owner worth a case. And DDoS, the objection continues, is the least sophisticated and least damaging of serious cyberattacks: it knocks a service offline temporarily, the service comes back when the attack stops, and no data is stolen and no system is permanently harmed. Booters are used by teenagers in gaming disputes; residential proxies are a gray-market nuisance. Compared to ransomware that destroys businesses or espionage that steals secrets, the objection concludes, the IoT worm is a nuisance-tier threat, and elevating it to a numbered case overstates a vector whose worst outcome is a website being briefly unreachable.

The register grants the small per-victim harm and rejects the nuisance framing on aggregate and consequence. Yes, a single conscripted camera loses little, and yes, DDoS steals no data — the case does not claim otherwise. But the objection commits the same error the open-database and default-password counter-narratives did: it measures the threat by the individual increment rather than the aggregate effect, and the aggregate is enormous. Mirai-class botnets have launched some of the largest DDoS attacks ever recorded, attacks that have knocked major internet infrastructure offline and taken down services relied upon by millions — a "temporary nuisance" that, at scale, has disrupted hospitals, banks, emergency services, and core internet infrastructure, with real-world consequences far beyond a gamer's grudge. And the residential-proxy use is not a nuisance at all: it is the laundering layer that hides the origin of fraud, credential-stuffing, and attack traffic across the whole criminal economy, quietly enabling harms the register documents elsewhere by making their perpetrators invisible. The IoT worm's harm is not concentrated in the conscripted camera; it is concentrated in the target of the cannon and the victim of the laundered fraud, and those harms are severe. Moreover, the case's deepest point is structural, not about severity: the IoT worm is the register's clearest proof that an inexhaustible population of unsecurable devices creates a permanent criminal capability that no endpoint fix can drain — which is a fact about the shape of the threat landscape worth a case regardless of how one scores DDoS. The nuisance framing looks at one borrowed camera and misses the army, the cannon, and the laundering network built from millions of them.

7. Disposition — PROXIED

Case 18 followed the IoT worm — the self-propagating Mirai-lineage malware that turns each device it takes into an instrument for taking the next, conscripting the vast, weakly-secured population of internet-connected devices into a botnet through the same default-credential door as Case 01. Its contagion logic — infect a device, use it to infect more — produces exponential growth that borrows the victims' own resources, and its host population is inexhaustible: billions of always-on, unmonitored, effectively un-patchable devices that will never be cleaned and are perpetually replenished. The honeypot catches the lineage first-hand, elf.mirai and elf.bashlite arriving at its door alongside the credential brute-forcing by which they spread.

The disposition — the foothold's fate — is PROXIED, because the conscripted device is rented, not mined: its bandwidth aggregated into a DDoS-for-hire cannon that floods targets off the internet, and its trusted residential IP address rented as a proxy to launder the traffic of anyone who needs to look like an ordinary home user. Both are the device sold as attack infrastructure, which is why the register records PROXIED — the IoT worm is a factory for attack capacity, and the disposition is the sale of that capacity. It diverges from Case 01's MINED at the same door because the disposition follows the operator's business, and the botnet herder rents armies where the cryptojacker mines coins: one door, two fates.

The defense is the trivial owner-side fix of Case 01 — change defaults, disable telnet, update, segment — plus the honest recognition that this cannot scale to billions of unattended devices, so the durable answer must reach the factory: secure-by-design manufacturing that ships no universal default credentials and can auto-update, increasingly mandated by regulation. The IoT worm is the register's clearest proof that some security problems cannot be solved at the endpoint, only upstream, before the insecure device is shipped. The vectors do not lie: the worm tried the factory password, the camera opened, and the camera joined the hunt for the next camera, until an army of borrowed devices stood ready to be rented — to drown a target, or to hide a stranger behind a home that was never theirs. We do not judge. We record. We let people judge — and then, if they are wise, stop the default at the factory, because the home will never change it.

Follow the Access continues. Case 18 disposition: PROXIED. Confidence: HIGH — the Mirai lineage and its self-propagation are extensively documented (source-code publication, YARA Mirai_Botnet_Malware, URLhaus/Mozi feeds); the honeypot captures elf.mirai and elf.bashlite/Gafgyt directly; and the DDoS-for-hire (booter/stresser) and residential-proxy markets that constitute the PROXIED disposition are well-documented. The MINED-vs-PROXIED divergence from Case 01 is argued from the operator's business rather than the shared door. The secure-by-design/manufacturer-responsibility defense follows CISA and IoT-security regulation. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the borrowed camera, the cannon built from millions of them, and the factory that shipped the door open.