Trend Micro Releases Study on Cyberattacks Targeting Home Routers

The research shows a recent spike in attacks targeting and leveraging routers, particularly around the fourth quarter of 2019.

FREMONT, CA: Global cybersecurity solutions leader, Trend Micro Incorporated, released new research warning consumers of a significant new wave of attacks attempting to compromise their home routers for use in IoT botnets. The report urges users to take action to stop their devices from enabling this criminal activity. The research shows a recent spike in attacks targeting and leveraging routers, particularly around the fourth quarter of 2019. It suggests that the increased abuse of these devices will continue as attackers can easily monetize these infections in secondary attacks.

"With a large majority of the population currently reliant on home networks for their work and studies, what's happening to your router has never been more important," said Jon Clay, director of global threat communications for Trend Micro. "Cybercriminals know that a vast majority of home routers are insecure with default credentials and have ramped up attacks on a massive scale. For the home user, that's hijacking their bandwidth and slowing down their network. For the businesses being targeted by secondary attacks, these botnets can totally take down a website, as we've seen in past high-profile attacks."

The company's research revealed that there had been an increase since October 2019 in brute force login attempts against routers, in which attackers use automated software to try common password combinations. The numbers increased nearly tenfold from around 23 million in September to 249 million attempts in December. In March 2020, Trend Micro recorded almost 194 million brute force logins.

Another indicator of the increase in the scale of attacks is the number of devices attempting to open telnet sessions with other IoT devices. Attackers favor telnet as it is unencumbered and offers a way to probe for user credentials. These figures hit a peak in March 2020, with nearly 16,000 devices attempting to open telnet sessions with other IoT devices in a single week.

This has proved to be a concerning trend for several reasons. Cybercriminals are competing with each other to compromise as many routers as possible so they can be conscripted into botnets. These are then sold on underground sites either to launch Distributed Denial of Service (DDoS) attacks or as a way to anonymize other attacks such as click fraud, data theft, and account takeover.