According to the report, there has been a recent spike in attacks targeting and leveraging routers, particularly around Q4 2019. The research, says the company, indicates increased abuse of these devices will continue as attackers are able to easily monetize these infections in secondary attacks unless users take action to stop their devices from enabling this criminal activity.
"With a large majority of the population currently reliant on home networks for their work and studies, what's happening to your router has never been more important," says Jon Clay, director of global threat communications for Trend Micro. "Cybercriminals know that a vast majority of home routers are insecure with default credentials and have ramped up attacks on a massive scale."
"For the home user, that's hijacking their bandwidth and slowing down their network," says Clay. "For the businesses being targeted by secondary attacks, these botnets can totally take down a website, as we've seen in past high-profile attacks."
The company's research revealed an increase from October 2019 onwards in brute force log-in attempts against routers, in which attackers use automated software to try common password combinations. The number of attempts increased nearly tenfold from around 23 million in September to nearly 249 million attempts in December 2019. As recently as March 2020, says the company, it recorded almost 194 million brute force logins.
Another indicator that the scale of this threat has increased, says the company, is devices attempting to open telnet sessions with other IoT devices. Because telnet is unencrypted, it's favored by attackers – or their botnets – as a way to probe for user credentials. At its peak, in mid-March 2020, nearly 16,000 devices attempted to open telnet sessions with other IoT devices in a single week.
The trend is concerning, says the company, and indicates that cybercriminals are competing with each other to compromise as many routers as possible so they can be conscripted into botnets. These