A sneak peek into recent IoT attacks

Zscaler ThreatLabZ documents active Mirai-derived IoT botnet campaigns (RIFT, Shaolin) observed in Dec 2018–Jan 2019 that exploit web-framework and device RCEs (ThinkPHP, Realtek Miniigd, D-Link, Netgear) to deliver multi-architecture payloads, recruit devices into botnets (and sometimes crypto-miners), and provides exploitation examples, post-exploitation steps, user-agents and a large set of IOCs for detection and remediation.