Loading story…
Multiple security commentaries highlighted that IoT devices are frequently compromised soon after deployment due to weak baseline security—especially unchanged default credentials and poor network segmentation. A SANS ISC guest diary described a real-world assessment where newly installed security-system components were reachable from user networks, still used a default root account, and had a trivially guessable password change (e.g., password to admin), illustrating how quickly attackers can discover and abuse exposed SSH/Telnet services when organizations lack a defined commissioning process to force credential rotation and isolation.
Separate perspective content similarly warned that IoT risk is often “baked in” at power-on and then persists for years because devices are rarely monitored or updated, while common product weaknesses (e.g., weak authorization, unauthenticated APIs, insecure data transmission, fragile session handling) create durable footholds that can bridge home, mobile app, and cloud accounts. The remaining items were largely opinion/marketing/event material (AI, IAM, cloud, RSAC session picks) or unrelated vulnerability/news headlines embedded in navigation blocks, and did not provide additional substantiated reporting on the specific IoT default-credential exposure theme.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-12, the SANS Internet Storm Center published a guest diary analyzing January honeypot data and later snapshots, linking repeated fingerprints and spikes in failed attempts to likely botnet-driven scanning. The write-up also provided defensive guidance including changing default credentials, using strong passphrases, MFA, segmentation, and continuous monitoring.
A vulnerability assessment described in the March 2026 SANS diary found a newly installed security system accessible with weak credentials and poor network segmentation. The example illustrated how IoT devices can be exposed and exploitable immediately after deployment.
An SC Media perspective published on 2026-03-09 argued that many IoT devices ship with insecure defaults, outdated firmware, weak authorization, insecure APIs, and poor session handling, while many manufacturers lack clear disclosure processes, patch timelines, and long-term support commitments. The article cited vendors such as Traeger and YoLink as examples where visible security processes and responsive remediation mattered.
Review of successful honeypot sessions during the January 2026 observation period showed attackers performing reconnaissance as well as more advanced actions such as adding SSH keys for persistence and attempting password changes. This demonstrated that compromise often progressed beyond simple login attempts once weak credentials were accepted.
From 2026-01-18 to 2026-01-25, an eight-day honeypot observation window captured tens of thousands of failed SSH/Telnet login attempts and more than a thousand successful logins using common usernames and weak passwords. The activity indicated widespread automated credential-guessing against internet-exposed devices.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA published guidance explaining why *secure* variants of common industrial communication protocols remain under-adopted across critical infrastructure OT environments, despite being available for decades. The guidance highlights persistent reliance on legacy protocols designed for uptime rather than security, leaving common gaps—**no authentication, no integrity, and no confidentiality**—that enable attackers with OT network access to impersonate devices, alter messages in transit, or issue unauthorized commands. CISA based its findings on interviews with asset owners/operators across sectors including Water/Wastewater, Transportation, Chemical, Energy, and Food/Agriculture, and pointed to secure alternatives such as **DNP3 Secure Authentication**, **CIP Security**, **Modbus Security**, and **OPC UA**, while noting real-world barriers like cost, complexity, and operational fragility. Separately, reporting described **Operational Relay Box (ORB)** networks—mesh-like relay infrastructure built from compromised IoT devices, SOHO routers, and VPS nodes—used by threat actors to obscure attack origins and blend malicious traffic into residential/business broadband patterns, complicating blocking and attribution. The ORB discussion was tied to a Singapore CSA disclosure that **UNC3886** targeted major telecom operators (M1, SIMBA, Singtel, StarHub), reportedly exploiting **zero-day perimeter firewall vulnerabilities** and deploying rootkits for stealth and persistence. In OT device security, CERT@VDE warned of a cluster of critical vulnerabilities in **WAGO 852 series industrial managed switches** (models `8052-1322` and `0852-1328`, firmware `2.64` and earlier), including **CVE-2026-22906** (hardcoded AES-ECB key enabling credential recovery from configuration files) and additional critical issues (CVSS **9.8**) in the web management stack (modified *lighttpd* and custom CGI) that can be triggered via oversized cookie parsing to crash devices or potentially enable remote code execution—conditions that materially increase the risk of remote takeover within OT networks.
Jun 29, 2026
Security researchers reported a **critical Moltbook** exposure caused by an unauthenticated database/API access issue that allowed enumeration of agent records (e.g., `GET /api/agents/{id}`) and leakage of **email addresses, JWT `login_token`s, and third-party `api_key`s**, enabling agent hijacking and downstream abuse of connected services. Separately, **Cal.com Cloud** was found vulnerable to a chained set of broken access controls and signup/invite-token logic flaws that enabled **complete account takeover** and access to sensitive booking data (attendee details, emails, and booking histories) at scale, including organizational accounts. In parallel, SentinelLabs documented that roughly **175,000 internet-exposed Ollama** instances were reachable due to common deployment misconfiguration (binding to `0.0.0.0`/public interfaces), creating conditions for **arbitrary code execution** and access to external resources—especially where tool-calling features were enabled. A distinct IoT case study described **Molekule** air purifiers exposing fleet-wide telemetry because an **AWS Cognito Identity Pool** permitted unauthenticated access to **AWS IoT Core MQTT** subscriptions, leaking device shadow data (e.g., Wi‑Fi SSIDs, MAC addresses, device names, sensor readings) for ~100,000 devices; the disclosed policy reportedly allowed read/subscribe access but not device control without per-device certificates.
Jun 29, 2026
Several high-severity vulnerabilities were disclosed across IoT/OT infrastructure products, creating pathways to **unauthenticated remote code execution** or full device compromise. **Ruckus vRIoT IoT Controller** was reported to contain two **CVSS 10.0** issues—`CVE-2025-69425` and `CVE-2025-69426`—driven by **hardcoded secrets/credentials** that enable attackers to bypass authentication and obtain **root-level command execution**, including via a service listening on **TCP port 2004**. Separately, Singapore’s **CSA** issued a high-priority alert for **Advantech** software affected by a **CVSS 10.0 SQL injection** (`CVE-2025-52694`) that allows an **unauthenticated remote attacker** to execute arbitrary SQL commands against exposed services, impacting multiple *IoTSuite* and *IoT Edge* components and requiring upgrades (some obtained via vendor support channels).
Jun 29, 2026