On February 26, 2025, Nokia Deepfield's Emergency Response Team (ERT) observed a "overnight" surge of hyper-volumetric DDoS attacks. Tracing them back revealed a botnet named Eleven11bot—a Mirai variant that specifically infects HiSilicon-based security cameras, DVRs, and NVRs. On February 27 it peaked at roughly 6.5 Tbps, surpassing the 5.6 Tbps record set just that January. This article unpacks the incident and the "edge-device war" behind it.

1. Mirai's ghost never left

Eleven11bot isn't a new family—it's a Mirai variant. Since Mirai's 2016 open-sourcing, its code has been reused and evolved by countless operators. This time it targeted HiSilicon devices running TVT-NVMS9000 video management software, gaining control via default credentials and unpatched firmware flaws. It uses a refined scanning algorithm to find exposed Telnet (port 23) and SSH (port 22), then brute-forces with credential dictionaries tailored to specific vendors (e.g., VStarcam).

2. 6.5 Tbps and a "numerical Rashomon"

The most fascinating part is the stark disagreement on botnet size:

  • Nokia estimated ~30,000 infected devices (US 24.4%, Taiwan 17.7%, UK 6.5%).
  • Shadowserver put the figure above 86,000.
  • GreyNoise / Censys argued the truly infected count is likely under 5,000 (61% traced to Iran).

The root of the disagreement: a misinterpreted network signature. The head[…]1111 marker seen in traffic was initially treated as an infection indicator, then attributed to normal HiSilicon SDK protocol behavior—a legitimate component of remote management in white-labeled IoT hardware. A reminder to every researcher: on the IoT battlefield, "seeing a device" is not "the device is infected"; misreading indicators directly distorts risk assessment.

3. Why IoT remains a weaponization hotbed

Eleven11bot isn't alone. In 2025, related CVEs kept surfacing and kept being ignored:

  • CVE-2024-32899: unauthenticated RCE in TVT NVMS—patch immediately.
  • CVE-2024-6047 / CVE-2024-11120: command injection in discontinued (EOL) GeoVision IoT devices, still unpatched months after disclosure.
  • CVE-2025-1316: command-injection zero-day in Edimax IC-7100 cameras, exploited in the wild by Mirai variants.

The underlying logic is constant: massive device proliferation (cameras, routers, smart TVs, even fridges), default credentials and poor patching hygiene, and unmonitored deployments. These devices "silently enlist" and converge into enormous attack fleets.

4. Real risk: intensity and collateral

Eleven11bot's attack intensity ranged from 100,000 to 500 million packets per second (pps), favoring telecom providers, game-hosting, and finance. Some attacks caused service degradation lasting days. Crucially, the traffic came from thousands of distinct ASNs—genuinely global nodes—meaning any organization depending on those paths can become collateral damage.

5. Defense: a shared responsibility

For device owners:

  • Disable remote administration, change default credentials, update firmware on HiSilicon-based gear.
  • Patch critical flaws like TVT-NVMS9000 (CVE-2024-32899).
  • Enable rate limiting for protocols like DNS (UDP/53) and NTP (UDP/123).

For networks and defenders:

  • Use threat-intel feeds like GreyNoise (which identified 1,042 malicious IPs) and Shadowserver to block known malicious IPs at the network layer.
  • Use SIEM to flag brute-force attempts on Telnet/SSH and anomalous outbound traffic from IoT devices.
  • Adopt zero-trust—isolate cameras and recorders from the business network.

Conclusion

Eleven11bot's lesson: IoT security isn't one company's job—it's a shared responsibility of manufacturers, regulators, security practitioners, and consumers. As long as vast numbers of devices sit on the public internet with default credentials and stale firmware, they will keep being weaponized. For defenders, the real barrier against this edge-device war is an architecture that identifies and diverts anomalous traffic from thousands of ASNs at the edge, mitigating within seconds.