A brand new botnet is providing record-sized DDOS attacks

A new discovery cyber botnet consists of about 30,000 webcams and video recorders (the largest concentration in the U.S.), said a Nokia security researcher that has communicated the largest denial of service attack ever.

The botnet was tracked under the name of Eleven11bot, first revealed in late February, when researchers in the Nokia Deepfield emergency response team observed a large number of geographically dispersed IP addresses and issued a “super attack.” Since then, Eleven11bot has been launching large-scale attacks.

Volume ddos ​​shuts down the service by consuming all available bandwidth within the target network or connecting to the Internet. This method works differently from exhausted DDOS, which overstretches the server’s computing resources. Treble attacks are volume ddos ​​that provide amazing data, usually measured in time per second.

Johnny-come the Botnet creates new records

On 30,000 devices, this device is already very large (although some botnets have more than 100,000 devices). Nokia researcher Jérôme Meyer told me that most of the IP addresses I participated in had never seen a DDOS attack.

In addition to the 30,000-node botnet overnight, another notable feature of Eleven11bot is the amount of data it sends the target’s record size. So far, Nokia’s largest Nokia happened on February 27, reaching 6.5 tons per second. Previous records of the predicted attack of 5.6 TBPS were reported in January.

“Eleven11bot targets different departments, including communications service providers and games hosting infrastructure, leveraging various attack vectors,” Meyer wrote. While in some cases, attacks are based on data volumes, others focus on flooded packets rather than what the connection can handle, ranging from “hundreds of thousands to billions of packets per second.” Service degradation caused by some attacks has been going on for several days, and as of the time the position went live, some people were still in progress.

The fault indicates that the maximum IP address concentration is 24.4%, located in the United States. Taiwan’s next step is 17.7% and the UK’s 6.5%.

In the online interview, Meyer put forward the following points:

• The botnet is much bigger than what we’ve seen in DDOS attacks (the only precedent I thought of is the 2022 attack after Ukrainian invasion, about 60k robots, but not publicly).
• Until last week, most of its IPs were not involved in DDOS attacks.
• Most IPS are security cameras (Censys thinks Hisilicon, and I have also seen multiple sources talking to Hikvision NVR, so this is possible, but not my area of ​​expertise).
• Part of this is that the botnet is larger than average and the attack size is larger than average.