The Persistent Threat of Default Credentials
National CERTs continue to issue warnings about active botnet families. A recent notice from China's National Network and Information Security Notification Centre highlighted five major cross-border threats: Mirai, CondiBot, Gafgyt, TBot, and SoftBot. The described intrusion methods were, predictably, Telnet and SSH brute-force attacks against unchanged factory default credentials, alongside exploitation of vulnerabilities disclosed years prior. This pattern is not new. What remains striking is not the malware's capabilities, but the continued availability of the same entry vectors in 2026.
The efficacy of brute-force attacks against default credentials hinges on two critical factors: the service must be accessible from the internet, and the default credentials must remain unaltered. Internet measurement data directly addresses the first condition, revealing a vast and persistently accessible attack surface.
Internet Measurement Reveals Widespread Reachability
Data from internet scanning services like ZoomEye is essential for understanding the scale of this problem. These services continuously probe the global network, cataloging open ports and running services. For Telnet (port 23) and SSH (port 22), the sheer volume of devices that remain exposed and listening is staggering. These devices, often IoT appliances, routers, and embedded systems, are frequently deployed with default usernames and passwords such as 'admin/admin', 'root/password', or manufacturer-specific combinations that are widely known.
The persistence of these open ports and default credentials suggests a fundamental failure in device management and security practices within the IoT ecosystem. Manufacturers often prioritize rapid deployment and low cost, neglecting secure configuration by default. End-users, particularly in enterprise or industrial settings where such devices are common, may lack the technical expertise or the awareness to change these default settings. This creates a fertile ground for automated attacks.
Consider the analogy of a house with its front door wide open and a sign saying 'Free to enter'. Even if the house contains valuable items, the primary barrier to entry is non-existent. Botnet operators automate the process of checking for these open doors and trying the most common keys (default credentials). The fact that CERTs are still reporting the same attack methods year after year indicates that millions of these 'doors' remain unlocked.
Why Aren't Default Credentials Changed?
Several factors contribute to the persistent use of default credentials. Firstly, many IoT devices are designed for plug-and-play simplicity. The initial setup process often prioritizes ease of use over security, leading users to skip or ignore prompts to change passwords. For consumer devices, users may not even be aware that changing the password is an option or a necessity. For industrial or enterprise IoT, the sheer scale of deployments can make manual credential changes for every device an insurmountable logistical challenge.
Secondly, the product lifecycle of many IoT devices is short, and manufacturers may not provide ongoing support or security updates. Once a device is deployed, it is often left with its factory settings for its entire operational life. This is particularly true for devices that are embedded within larger systems or are difficult to access for configuration.
The 'unchanged factory credentials' are not just a technical oversight; they represent a systemic issue in device security and user education. The problem is compounded by the fact that many of these devices are not designed with security as a primary consideration. They often run older, unpatched operating systems and lack robust security features, making them prime targets for exploitation beyond simple credential stuffing.
The Botnet Landscape: A Stable Attack Surface
The botnet families mentioned in the CERT notice—Mirai, CondiBot, Gafgyt, TBot, and SoftBot—are well-established threats. Their continued prevalence is a direct consequence of the stable, exploitable attack surface. Mirai, for instance, gained notoriety for its ability to scan for vulnerable IoT devices and infect them rapidly. Its continued success means that new variants and similar botnets can emerge, all leveraging the same fundamental weaknesses.
These botnets are not sophisticated in their initial access. They rely on brute-force scanning and known exploits. The 'interesting' part is not the malware's payload, which can range from DDoS capabilities to cryptocurrency mining or acting as proxy servers, but the fact that the initial entry point remains as accessible as it was when these botnets first appeared. This suggests that the cybersecurity industry's efforts to patch systems and educate users are not keeping pace with the sheer volume of vulnerable devices being deployed and left unmanaged.
The persistence of these attack vectors raises a crucial question: what is the long-term strategy for securing millions of deployed IoT devices that are difficult or impossible to update? Without a fundamental shift in device design, manufacturing responsibility, and deployment practices, the same botnets, or their successors, will continue to find the same open doors.
Implications for Security Professionals
For security professionals, this situation demands a proactive approach focused on network segmentation and vulnerability management. Relying solely on patching is insufficient when devices are unpatchable or unmanaged. Implementing network access controls, monitoring for unusual outbound traffic from IoT devices, and actively scanning internal networks for devices using default credentials are essential steps.
Furthermore, procurement policies must prioritize devices that offer secure configuration options and demonstrate a commitment to ongoing security support. The continued reliance on Telnet and SSH with default credentials is not merely a nuisance; it's a gaping hole in network defenses that botnet operators are exploiting with relentless efficiency. The fact that these same vulnerabilities are highlighted year after year signifies a widespread, ongoing failure in IoT security hygiene.