Enterprise Risks from Insecure Third-Party IoT Devices and Botnets

Organizations face significant cybersecurity risks from the proliferation of insecure third-party Internet of Things (IoT) devices, which often lack robust security controls and are increasingly targeted by cybercriminals. The BADBOX 2.0 botnet exemplifies this threat, having infected over a million low-cost Android-based IoT devices such as smart TVs, many of which are shipped with preinstalled malware or compromised through malicious applications. These infected devices are then leveraged to create large-scale residential proxy networks, enabling cybercriminals to conduct ad fraud, credential stuffing, and other illicit activities while masking their true origins. The FBI has warned that compromised IoT devices are being abused at scale, including on home and small office networks used for work, making them a significant liability for enterprises when connected to corporate environments.

The rapid growth of IoT adoption—currently estimated at over 17 billion connected devices worldwide—has expanded the attack surface for organizations, introducing challenges such as limited device resources, inconsistent security measures, and the need for strong authentication and encryption. Security experts recommend that organizations implement rigorous procurement controls, demand verifiable updates and transparent software bills of materials from vendors, and develop comprehensive IoT security strategies that include proactive threat detection and end-to-end security frameworks. Robust IoT software testing and policy development are essential to mitigate these risks and ensure the secure operation of IoT devices within enterprise networks.