ESET 防毒軟件連續 12 年榮獲「香港最受歡迎品牌」大獎
他們覬覦你的資料：什麼是資訊竊取（Infostealer）軟件？你該如何確保安全？
在網絡犯罪的世界裡，資訊是達成目的的手段，而這個目的往往是為了牟利。這就是為什麼資訊竊取惡意軟件已成為身分詐欺、帳戶接管和數碼貨幣竊盜的主要驅動因素。但也有許多人，他們大部分的日常生活都在網絡上進行，卻仍能確保自身安全。關鍵在於了解如何有效地管理數碼風險。
以下是你需要了解的重點，以保護你的個人和財務資訊免遭危害。
資訊竊取軟件會竊取哪些資訊？
許多資訊竊取軟件可追溯其源頭至一個「指標性」的惡意軟件：名為 ZeuS 的銀行木馬程式，其設計目的是暗中竊取受害者的財務資訊，例如網絡銀行的登入憑證。當其原始碼於 2011 年外洩後，新變種便充斥於網絡犯罪黑市，促使資訊竊取產業蓬勃發展並正式成形，開發者不斷升級和客製化其功能。如今，從 Windows PC、macOS 電腦到 iOS 和 Android 裝置，幾乎每個運算平台都有其對應版本。
資訊竊取軟件覬覦的目標取決於其變種。登入憑證和會話 Cookie（可能讓黑客藉此繞過多重要素驗證 MFA）是主要目標之一。一份報告估計，去年被竊的 32 億筆憑證中，高達 75%（21 億筆）是透過資訊竊取軟件所收集。其他可能面臨風險的個人和財務資訊包括：
- 支付卡、銀行帳戶和加密貨幣詳細資訊（例如：加密錢包金鑰）
- 其他財務資訊，包括保險或政府福利（如社會安全）詳細資料
- 瀏覽器資料，包括瀏覽紀錄和任何「已儲存表單」資料，其中可能包含支付細節和密碼
- 你的電腦或裝置的系統資訊
- 儲存在你的裝置 / 機器上的檔案，包括相片和文件
- 其他個人資訊，包括姓名、電話號碼和地址
資訊竊取軟件如何運作？
這類惡意軟件的目的，是在你不知情的狀況下迅速找出裝置或電腦中的敏感資訊，然後將其竊取並傳送至攻擊者控制的伺服器。它會透過掃描網頁瀏覽器、電子郵件客戶端、加密錢包、檔案、應用程式以及作業系統本身來達成。其他技術包括：
- 「表單擷取」（Form grabbing）：在你將登入資訊輸入線上表單、傳送到安全伺服器之前，就先行攔截。
- 「按鍵記錄」（Keylogging）：惡意軟件記錄你所有的鍵盤輸入。
- 螢幕截圖：擷取你的主畫面 / 桌面截圖，以防有敏感資訊顯示其上。
- 剪貼簿竊取：竊取儲存在系統剪貼簿中的資訊。
- 一旦資訊被傳回攻擊者的伺服器（過程通常僅需數秒），他們會將其打包成日誌（Logs），並在網絡犯罪黑市上販售。詐騙者接著會利用這些資訊來：
- 劫持你的網上帳戶（如 Netflix、Uber），竊取內部儲存的資訊或將存取權限轉賣他人。
- 進行身分詐欺，例如用你的名義申請貸款，或使用你的卡片 / 銀行帳戶消費。
- 進行醫療 / 保險詐欺，用你的名義獲取醫療服務或藥物。
- 進行稅務詐欺，用你的名義報稅並領取退稅款。
- 向你的聯絡人發送釣魚訊息或垃圾郵件。
- 盜領你金融帳戶中的資金。
我可能如何遭到資訊竊取軟件入侵？
要防範資訊竊取軟件，首要步驟是了解其散播途徑。常見的攻擊媒介包括：
- 網絡釣魚郵件 / 短訊：典型的社交工程手法，誘騙收件人點擊惡意連結或開啟附件，從而觸發惡意軟件的暗中安裝。威脅行為者通常會冒充可信的個人、品牌或機構，甚至偽造寄件人網域並使用官方標誌。
- 惡意網站：可能作為釣魚活動的一環，或是獨立的攻擊媒介。使用者可能被誘騙下載檔案或點擊連結，有時甚至只要造訪該網站就可能觸發「路過式下載」（Drive-by-Download）。威脅行為者可能利用黑帽 SEO 技術，人為提高這些惡意網站在搜尋引擎結果中的排名，讓你更容易在搜尋時點入。
- 遭入侵的網站：有時黑客會入侵你可能瀏覽的合法網站，藉此植入惡意程式碼，例如利用瀏覽器漏洞或插入惡意廣告（Malvertising）。這兩種方式都可能導致資訊竊取軟件被安裝。
- 惡意應用程式：看似合法的軟件或 App 在下載後可能內藏竊取資訊的惡意程式碼。對於防護通常不如電腦完善的流動裝置而言，風險尤其顯著。要特別留意熱門遊戲或其他軟件的盜版。
- 社交媒體詐騙：詐騙者可能利用誘人的廣告或貼文（例如假冒名人或盜用他人帳號發文）誘騙你點擊。對於看起來好得不真實的優惠、抽獎或獨家內容應抱持懷疑。
- 遊戲模組 / 作弊程式：非官方的遊戲修改檔或作弊工具可能夾帶資訊竊取惡意軟件。例如，ESET 研究人員曾發現，有 GitHub 儲存庫聲稱提供 Hamster Kombat 遊戲的輔助工具（如農場機器人、自動點擊器），實則暗藏 Lumma Stealer 變種病毒。
深入剖析威脅情勢
正如 ESET 在其 H2 2024 威脅報告中所揭示，資訊竊取軟件市場對網絡犯罪分子而言，利潤豐厚。「惡意軟件即服務」（MaaS）模式降低了取得多種資訊竊取軟件變種的門檻，這些變種在犯罪市集上隨處可見。部分網站甚至提供日誌解析服務，協助犯罪分子從原始日誌中提取可用或轉售的資料。
ESET 指出，這些惡意軟件持續演進。例如，自 2021 年即開始活躍的 Formbook，近期加入了更複雜的混淆技術，意圖增加安全研究人員進行樣本採集和分析的難度。雖然像 RedLine 這類的變種因執法機關的聯合打擊而銷聲匿跡，但其他如 Lumma Stealer 等變種則迅速填補空缺。根據 ESET 的研究，Lumma Stealer 在 H2 2024 的偵測數量年增率高達 369%。
如何遠離資訊竊取軟件？
那麼，該如何確保你的流動裝置或電腦不被資訊竊取軟件入侵呢？由於惡意軟件可透過多種途徑散播，你需要謹記以下幾項最佳防護措施：
- 安裝並及時更新安全軟件：在所有裝置上都這樣做，能大幅提升你抵禦資訊竊取軟件及其他威脅的能力。
- 具備釣魚防範意識：避免點擊任何不明訊息中的連結或開啟附件。若對訊息來源有疑慮，應透過其他管道獨立聯繫寄件人確認。有時，將滑鼠游標移至寄件人欄位上方，就能識破其真實來源是否被偽造。
- 僅從官方應用程式商店下載軟件：雖然 Google Play 等官方商店偶爾也會出現惡意軟件，但通常能迅速下架，整體而言遠比第三方商店安全。切勿下載任何盜版或破解軟件，尤其是標榜免費的。
- 維持作業系統與應用程式更新：務必將系統和應用程式更新至最新版本，因為最新版通常也修補了已知的安全漏洞。
- 謹慎使用社交媒體：記住「好得不真實」的優惠通常是陷阱。若感到可疑，可先透過 Google 搜尋查證是否為已知騙局。同時要了解，朋友或名人的帳號也可能被盜用來散播詐騙訊息。避免點擊任何不明連結。
- 強化登入安全：為每個帳戶設定強度高且獨一無二的密碼，並使用密碼管理器儲存。為所有支援的帳戶啟用多重要素驗證（MFA）。雖然 MFA 無法百分之百防堵所有資訊竊取手法（例如某些繞過方式），但能有效防禦按鍵記錄等攻擊。
關鍵在於多層次地部署這些防護措施，以縮減黑客可利用的攻擊破口。但同時也要記住，黑客會不斷尋找新的攻擊手法與漏洞，因此時刻保持警覺至關重要。
關於ESET
ESET成立於1992年，是一家面向企業與個人用戶的全球性的電腦安全軟件提供商，其獲獎產品 — NOD32防病毒軟件系統，能夠針對各種已知或未知病毒、間諜軟件 （spyware）、rootkits和其他惡意軟件為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少，偵測速度最快，可以提供最有效的保護，並且比其他任何防病毒產品獲得了更多的Virus Bulletin 100獎項。ESET連續五年被評為“德勤高科技快速成長500 強”（Deloitte’s Technology Fast 500）公司，擁有廣泛的合作夥伴網絡，包括佳能、戴爾、微軟等國際知名公司，在布拉迪斯拉發（斯洛伐克）、布裏斯托爾（英國 ）、布宜諾斯艾利斯（阿根廷）、布拉格（捷克）、聖地亞哥（美國）等地均設有辦事處，代理機構覆蓋全球超過100個國家。
關於 Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
Cyber Kill Chain: What Is It? Examples and Prevention
Organizations must predict and stop assaults before they become more severe in a time when cyber attacks are more advanced than ever. Developed by Lockheed Martin, the Cyber Kill Chain is still among the most often applied models for analyzing and reducing cyberattacks. By separating an attack into seven separate phases, this strategy gives cybersecurity professionals a methodical approach to identifying and countering attacks.
Following the Cyber Kill Chain model, cybercriminals keep improving their strategies in reaction to changing cybersecurity policies. From ransomware gangs to state-sponsored attackers, the approach is essentially the same. We will look at the seven phases of this approach and how businesses may protect against each level.
What is the Cyber Kill Chain?
The Cyber Kill Chain offers a methodical approach to studying cyberattacks. Breaking an attack into several phases helps security professionals identify weaknesses and stop hostile activity before it becomes more serious.
The methodology is especially successful against advanced persistent threats (APTs), in which cybercriminals or nation-state actors carry out prolonged, covert attacks to pilfer sensitive data or disturb operations.
The Seven Stages of the Cyber Kill Chain: How They Work
The seven steps that make up the Cyber Kill Chain each mark a crucial turning point in the development of an attack:
Step 1: Reconnaissance
Attackers compile knowledge of their target in this phase. They find weak areas by scanning networks and examining publicly available data. Cybercriminals could employ methods including:
- Open-source intelligence (OSINT) involves compiling from job ads, the internet, and social media.
- Scanning tools for unpatched systems and obsolete software detection
- Social engineering methods to gather login passwords from gullible staff members.
Prevention tips: To stop these attacks, companies should restrict public access to sensitive data, track network activity for reconnaissance efforts, and provide security awareness training.
Step 2: Weaponization
Once the assailant has sufficient knowledge, they produce a hostile payload to exploit found weaknesses. This can encompass:
- Development of malware—including ransomware, trojans, spyware.
- Weaponized scripts or papers meant for attacking upon opening.
- Modification of current malware to evade systems of detection.
Prevention tips: Security teams should routinely update software to fix vulnerabilities, apply robust email security solutions, and examine dubious data using sandboxing.
Step 3: Delivery
During this phase, the attacker delivers the harmful payload to the target. Typical ways of delivery consist of:
- Phishing emails loaded with dangerous attachments or links.
- Drive-by downloads from either hostile or hacked websites.
- USB devices or other external media corrupted with a virus.
Prevention tips: Email screening, online filtering, and staff training help businesses identify phishing efforts. Additionally, identifying and blocking corrupt files is an endpoint security solution.
Step 4: Exploitation
Once the payload reaches the target, it uses system weaknesses to carry out destructive intent. One can experience exploitation via:
- Software or operating system weaknesses.
- Passwords, weak or recycled.
- Human mistakes, including allowing macros in hostile papers.
Prevention tips: Strict access control policies, patch management, and frequent vulnerability analyses help to lower exploitation risk. Using multi-factor authentication (MFA) lends another degree of protection.
Step 5: Installation
The attacker installs malware at this point to stay on the hacked system. This could entail:
- Putting trojans or backdoors for distant access.
- Changing systems to stop detection.
- Using rootkits to get thorough system access.
Prevention tips: Endpoint detection and response (EDR) systems help to spot and stop illegal installations. Organizations should also constantly monitor for unusual system behavior.
Step 6: Command and Control (C2)
Through communication with the hacked system, the assailant enables orders, data theft, or network spread of malware. C2 servers streamline:
- Remote control of compromised devices.
- Lateral movement in the network.
- Carrying out more hostile acts.
Prevention tips: Threat intelligence technologies, intrusion detection systems (IDS), and network segmentation can assist in identifying and stopping C2 communications. Additionally, blocking suspicious outbound traffic helps attackers to lose control.
Step 7: Actions on Objectives
In this last phase, the assailant carries out their ultimate objective, maybe:
- Data exfiltration—stealing private data for espionage or financial gain.
- Encrypting files and requesting payment for decryption forms ransomware deployment.
- System disturbance brought on by destructive attacks causes operational downtime.
Prevention tips: Strong encryption techniques, incident response strategies, and data loss prevention (DLP) solutions help reduce harm. Additionally, routine security audits help spot weaknesses before they are exploited.
🔐 Cyber Kill Chain – Cheat Sheet
| Step | What Happens | Example |
|---|---|---|
| 1. Reconnaissance | Gather info on target | Scanning for open ports or employee emails |
| 2. Weaponization | Craft malware/exploit for specific vulnerabilities | Creating a trojan-loaded PDF |
| 3. Delivery | Send malicious payload to target | Phishing email with malicious link |
| 4. Exploitation | Activate malware via a system vulnerability | User opens infected file |
| 5. Installation | Install backdoor or malware to maintain access | Dropping a remote access trojan |
| 6. Command & Control (C2) | Connect back to attacker for remote control | Malware contacts attacker’s server |
| 7. Actions on Objectives | Execute mission (data theft, ransomware, etc.) | Stealing data, encrypting files |
Real-World Examples of Cyber Kill Chain Attacks
APT29, Russian State-sponsored Attack
APT29, sometimes referred to as Cosy Bear, has been connected to cyber espionage efforts directed against businesses and government entities. This group uses the Cyber Kill Chain concept, which consists of:
- Doing thorough target reconnaissance.
- Delivering malware via emails sent under spear-phishing.
- Keeping persistence and extracting data using cutting-edge methods.
WannaCry Ransomware Attack
WannaCry sent ransomware all over using a weakness in Microsoft Windows. The attack followed the guidelines of the Cyber Kill Chain:
- Reconnaissance: Looking for systems lacking SMB patches.
- Distribution: Let self-replicating worms spread malware.
- Exploitation: Encrypting important files and requesting a ransom payment marks exploitation.
These cases emphasize the need for proactive security policies to stop such assaults.
Preventive Techniques at Every Level
Organizations should use a tiered security strategy to break the Cyber Kill Chain when disrupting every level of an attack:
- Reconnaissance: Use threat intelligence tools and keep an eye on assets pointing outward.
- Weaponization: Weaponizing tools from malware analysis help identify new dangers.
- Delivery: Use cutting-edge email and web security systems.
- Exploitation: Use regular software updates and strict access policies to prevent exploitation.
- Installation: Install endpoint protection systems to find illegal programs.
- Command and Control: Use network segmentation and anomaly detection under command and control to avoid correspondence in hostile servers.
- Actions on Objectives: Real-time monitoring and data encryption will help stop system penetration and data theft.
Backup as a Response to Cyberattack
In the face of escalating cyber threats, robust backup and recovery solutions are essential for organizations to ensure data integrity and business continuity. Storware Backup and Recovery offers an enterprise-grade, agentless solution that caters to diverse environments, including virtual machines, containers, cloud instances, and applications. Its architecture emphasizes centralization and unification of backup management, providing a resilient defense against ransomware attacks and other cyber incidents.
Storware’s comprehensive feature set includes immutable backup storage, which prevents unauthorized modifications and enhances protection against ransomware. The solution supports snapshot management, enabling automated creation, retention, and recovery processes that reduce recovery time objectives (RTO) and recovery point objectives (RPO). Additionally, Storware offers policy-based automation for granular control over backup scheduling and retention policies, ensuring that organizations can tailor their data protection strategies to specific business needs.
By integrating advanced security features such as role-based access control (RBAC), audit logs, and data-at-rest encryption, Storware not only safeguards critical data but also aligns with regulatory compliance requirements. Its scalability and versatility make it suitable for organizations of all sizes, providing a reliable foundation for disaster recovery and operational resilience in the event of cyberattacks.
Final Thoughts
The Cyber Kill Chain is a useful structure for comprehending cyberattacks and improving defense plans. Knowing the several phases of an attack helps companies apply focused security protocols to prevent risks before they cause major damage.
Since hackers constantly modify their approach, organizations must be vigilant, aggressive, and adaptable in their cybersecurity activities. Modern security measures, constant personnel training, and comprehensive incident response plans are essential in the digital age.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Storware
Storware is a backup software producer with over 10 years of experience in the backup world. Storware Backup and Recovery is an enterprise-grade, agent-less solution that caters to various data environments. It supports virtual machines, containers, storage providers, Microsoft 365, and applications running on-premises or in the cloud. Thanks to its small footprint, seamless integration into your existing IT infrastructure, storage, or enterprise backup providers is effortless.
What Is Internet of Things (IoT) Security?
:format(avif))
What is IoT?
The Internet of Things (IoT) is what we call networks of physical objects that are packed with sensors, cameras, listening devices, and other technologies—like today’s smartphones, appliances, wearables, and cars. These devices are connected over the internet or a local network, so they can exchange data with each other. This allows them to work together as part of a smart system, enabling the automation of tasks and the creation of intelligent environments like smart homes or smart workplaces. Because of the way IoT devices operate, the Internet of Things and cybersecurity must go hand in hand to deliver smart experiences while ensuring safety and privacy for all users.
What is IoT security?
IoT security is all about protecting the interconnected smart devices and the networks they connect to. Since these devices can collect, store, and share data about users’ surroundings, this data must be handled with the utmost care and caution.
IoT devices aren’t just for personal use—more and more are making their way into workplaces. For example, businesses now install smart thermostats, blinds, and seating planners to optimize resources in their offices.
The benefit of these devices syncing and working together is that they regularly share and communicate data to improve functionality. However, since these devices are interconnected, gaining access to one could allow bad actors to exploit and breach your entire network. That’s why Internet of Things device security (as well as IoT network security) is essential to prevent vulnerabilities that could lead to cyberattacks.
Why is IoT security important?
The recent influx of IoT devices has provided another avenue for hackers to exploit in recent years. IoT devices can be particularly vulnerable to security breaches. At the end of 2021, a study concluded that up to 82% of healthcare organizations experienced an IoT cyberattack over 18 months. There are often security oversights regarding the IoT and its apps. For example, a German teenager hacked Tesla vehicles’ app component not that long ago. While he couldn’t access the driving functions like steering or brakes, he could still exploit other potentially dangerous features like unlocking doors, playing music at max volume, and flashing lights. The more IoT devices become common, the more widespread their security threats will become.
Which industries need IoT security?
Smart devices have made their way into almost every part of our lives. However, some industries rely more heavily on IoT technology than others and require additional security due to its strategic meaning for the nations’ and communities’ welfare.
Healthcare
Patient monitoring, advanced medical equipment, administering treatments and vaccines: Medical services increasingly rely on smart devices. Cynerio and Ponemon’s Study proves that healthcare is especially vulnerable to cyber attacks involving the Internet of Things devices as they constitute 88% of all hospital data breaches. More than half of hospitals in the US have experienced an attack on their smart devices between 2020 and 2022. The damage that cybercriminals can cause in healthcare is horrifying — the mortality rate increased in 24% of the attacked hospitals.
Energy and Utilities
Internet of Things devices are widely used in the energy and utilities sector for smart grid management, optimizing energy consumption, and remote monitoring of infrastructure. Monitoring devices such as smart meters, security cameras, and temperature/fire/chemical leak controls are prime targets for cybercriminals. Protecting energy infrastructure is essential to prevent disruptions to critical services, including electricity, heating, traffic control, or medical care.
Manufacturing
It’s hard to imagine a modern factory without Internet of Things solutions enabling process automation, supply chain management, and predictive maintenance. The endless possibilities that smart devices present to this sector can be overshadowed by the costs of cyberattacks, as hackers often target factories to demand ransom.
Logistics
IoT devices are entering the logistics industry through fleet, vessel, and traffic management systems. Self-driving vehicles are becoming commonplace in major cities. Also, the railway relies on Internet of Things devices for traffic planning and power supply management. Hacking an IoT-reliant logistics system could cause chaos on highways or railroads.
Supply Chain
In the supply chain industry, connected devices are used for tracking, monitoring, and managing goods throughout transportation. The security risk created by IoT tools used in day-to-day operations grows with the number of vendors a company cooperates with. Supply chain attacks often target third-party partners or suppliers to access the company’s assets.
IoT security challenges
While smart devices introduce plenty of opportunities and convenience to our lives, they also open up the possibility of cyberattacks. Industries such as healthcare and manufacturing increasingly rely on IoT devices, exposing unprepared organizations to cyberattacks. Here are some of the threats IoT devices are susceptible to:
Malware: Because cybersecurity isn’t the primary concern of many smart devices, hackers don’t require advanced malicious software to attack. Rudimentary malware can steal data and cause damage to networks and devices. Mirai is used to infect security cameras, scan the network for the IP address of IoT devices, and connect. This allows hackers to launch significant DDoS attacks.
Credential-based attacks: Using stolen login IDs and passwords is a popular method for hackers because many people’s logins are already floating around online thanks to massive data leaks such as Collection #1. Once a business’s smart device’s application layer is breached, hackers can access any device connected to the network.
Data theft and exposure: Adding IoT devices to your home or office will introduce more potential entry points for hackers to access data. This increases the risk of personal information being stolen and exposed on the internet. A good example of this is when hackers used Amazon’s Alexa to issue self-commands allowing the attackers to control smart lights, buy items on Amazon, and tamper with calendars.
Incorrect device management and configuration: Similar to the above, the more devices and accounts you add, the greater the chance of reusing passwords and usernames. Companies often ship IoT devices with default logins that should be changed during their setup. However, a survey of CIOs and IT managers showed that almost 50% of them allowed IoT devices onto their corporate network without changing the default passwords.
Complex ecosystem and smart device diversity: An office’s IoT ecosystem can quickly become a juggernaut of interconnected devices. These devices have many moving parts that operate at different levels. Overseeing and managing your wide array of IoT devices will help you prevent IoT attacks.
Not following security by design: Cybersecurity is generally not the main focus of many IoT devices, often taking a backseat to its functionality. Your office’s IoT security could be at risk because specific devices may have cybersecurity weaknesses that need to receive software updates. There’s also the possibility that any security features may be obsolete if the product is discontinued and no longer supported by its developer.
Examples of IoT security threats
Jeep Grand Cherokee
Back in 2015, security researchers Charlie Miller and Chris Valasek set out to see if they could remotely hack into and take control of a new Jeep model—the Jeep Grand Cherokee. They ran a series of cybersecurity tests, and sure enough, they found a major backdoor in the Jeep’s built-in infotainment system, which handles things like navigation and entertainment.
Using this vulnerability, they were able to connect to the car’s other systems and take control of the car’s key mechanics like braking, engine control, air conditioning, and transmission. Basically, they turned that Jeep into one of the most expensive remote-controlled toy cars in the world! After this demonstration, Chrysler (the owner of Jeep) had no choice but to recall more than 1 million Grand Cherokees to fix the software vulnerability.
Mirai botnet
Probably the most famous—or infamous, actually—IoT security breach ever, the Mirai botnet was first identified in 2016 and has remained a persistent cyber threat ever since. It works by infecting vulnerable IoT devices—like AVTECH CCTV cameras and Four-Faith industrial routers—and using them to launch large-scale distributed denial-of-service (DDoS) attacks.
In 2018, a Mirai variant was used in a 1.35 Tbps DDoS attack against GitHub, briefly knocking the platform offline. In 2020, the FBI issued a warning that Mirai-based attacks could go beyond websites and target critical infrastructure, like power grids and industrial systems.
But here’s the real problem: the Mirai botnet is still out there. Its original creators released the source code online, and since then, cybercriminals worldwide have been modifying and weaponizing it. Even today, in 2025, Mirai-based botnets are still behind record-breaking cyberattacks, targeting everything from internet service providers to government networks.
ThroughTek
In 2021, security researchers uncovered a serious flaw in ThroughTek’s IoT software, which is used in millions of smart cameras, baby monitors, and security systems around the world. It turned out that hackers could use this vulnerability to remotely access live video and audio streams from the cameras, and in some cases, even take full control of these devices, exposing sensitive footage from homes and businesses in the process.
The vulnerability was so severe that the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning, rating it 9.1 out of 10 on the severity scale.
How to secure IoT devices
The good news is that maintaining an overall good cybersecurity policy for your company will help safeguard your IoT devices. Training your staff with cybersecurity best practices and appointing specific admin roles to deal with the security of IoT devices in your organization are all methods for securing your business from IoT threats.
Regularly updating and checking IoT devices for patches: By staying up to date with your IoT devices’ firmware, you’re better equipped to protect your workplace from ever-evolving cyber threats. While people regularly update their computers and phones, they may forget to update their IoT devices.
Monitoring device behavior: By knowing your device’s base behavior and aspects such as its performance or regular network activity, you can recognize irregular behavior and intervene if you notice any deviations to your device’s performance.
Using strong and unique passwords: Using a password manager for your organization helps secure your IoT data security. NordPass Business creates unique, complex passwords. Additionally, it regularly reminds you to update passwords if they’re old, reused, or weak.
Checking app permissions for IoT devices: If an IoT device comes with an app, it is better to review the permissions it’s requesting before allowing access to your device or network. You shouldn’t grant apps more permissions than are strictly necessary.
Applying network segmentation and network security: Your workplace should have a way to monitor network activity and any devices connected to it. Tracking this information will help you recognize irregular internet traffic and act as an additional layer of security. This means that if one device is affected by an attack, it won’t be passed on to your other devices.
Considering additional security solutions and tools: To secure the app component of IoT devices, consider only accessing the app via a VPN. Doing so will encrypt the data transferred and give your network an extra layer of security.
Using multi-factor authentication (MFA): The more layers of security (authentication factors) smart devices used in your workplace have, the safer your company assets are. Incorporating additional factors to authenticate the user, such as biometric data or the user’s geolocation, makes your IoT devices less vulnerable to cyber attacks.
Applying Cloud IoT Security: Many IoT applications leverage cloud computing for storing, processing, and analyzing data. Therefore, it’s essential to implement security strategies, procedures, and tools that encompass cloud security if your organization utilizes smart devices.
How NordPass Business boosts your IoT security
The surge of IoT devices in private and professional settings provides more potential routes for hackers to steal valuable data and information. These devices and networks are more intertwined than ever, meaning cybersecurity for IoT shouldn’t be ignored. For companies working with large amounts of data, NordPass Enterprise is the cybersecurity solution you’re looking for. With NordPass, you can securely store and share login credentials for all your accounts and generate strong, unique logins in no time. NordPass allows you and your colleagues to quickly access important office notes (alarm PINs, WiFi passwords, and recovery codes) in one place.
About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
