New Eleven11bot Hacks 86,000 IP Cameras for Large-Scale DDoS Attack

The Eleven11bot malware has compromised over 86,000 IP cameras in the Asia-Pacific (APAC) region, creating a botnet for Distributed Denial of Service (DDoS) attacks.

This incident, highlighted in StormWall’s Q1 2025 DDoS overview, emphasizes the growing sophistication of cyber threats targeting Internet of Things (IoT) infrastructure.

Unprecedented Breach Exploits IoT Vulnerabilities

The attack has affected sectors such as telecommunications and government systems, stressing the need for enhanced cybersecurity measures in an increasingly interconnected environment.

The Eleven11bot exploits vulnerabilities in IP camera firmware, using weak default credentials and unpatched software to take control of devices. Once infected, these devices execute multi-vector DDoS attacks, employing UDP, TCP, and HTTP floods. This approach mirrors tactics used in carpet bombing campaigns, which increased by 96% in APAC during Q1 2025.

StormWall’s data reveals these attacks often maintain traffic volumes below detection thresholds, challenging legacy DDoS mitigation tools. This can lead to the collapse of critical infrastructure, particularly in telecommunications, which experienced a 136% year-over-year increase in attack volume.

The largest mitigated attack reached 2.3 Tbps against a data center in China, while a telecom service in Taiwan faced an 11-day assault at 850 Gbps, illustrating the scale and persistence of these threats.

Sophisticated Tactics Amplify DDoS Impact in APAC

The Eleven11bot botnet has increased the impact of API-targeted DDoS attacks by 74%. These Layer 7 attacks mimic legitimate requests, targeting resource-intensive endpoints and causing application crashes.

Government infrastructure has been a particular target, with Taiwan experiencing attacks averaging 600–900 Gbps. Additionally, India-Pakistan tensions have resulted in attacks on government portals at 50–100 Gbps. The entertainment sector, including online gaming and streaming, saw a 114% increase due to competitive sabotage and extortion in markets like China, India, and Korea.

This situation underscores the need for advanced defenses, such as deep packet inspection and AI-driven traffic analysis, to address application-layer vulnerabilities. With China being the most targeted APAC country (22% of attacks) and Taiwan’s share increasing to 14% due to hacktivist campaigns, the necessity for adaptive cybersecurity strategies is evident.

The exploitation of 86,000 IP cameras by Eleven11bot highlights the importance of securing IoT ecosystems against future cyber threats.

Based on reporting by GBHackers.