{"id":308,"date":"2018-11-29T15:00:05","date_gmt":"2018-11-29T13:00:05","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=308"},"modified":"2026-06-08T23:15:27","modified_gmt":"2026-06-08T23:15:27","slug":"italian-iot-devices-cyber-attacks","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/italian-iot-devices-cyber-attacks\/","title":{"rendered":"Italian IoT devices abused for cyber attacks"},"content":{"rendered":"

The FortPot<\/em><\/strong> honeypot network identified numerous brute force attacks<\/strong>. The majority of these originate from devices compromised by malware<\/strong> (for example Mirai<\/em>) subsequently leveraged as propagation vectors. Systems connected to the IP addresses presented in this article conducted access attempts against SSH and TELNET services in November 2018<\/strong>. Credential enumeration campaigns of this nature typically employ T1110 (Brute Force) techniques against T1021.004 (SSH) and T1021.005 (Telnet) protocols, with infected hosts acting as distributed attack sources under T1570 (Lateral Tool Transfer) patterns. Organizations operating internet-facing authentication services should consult Cybersecurity Advisory<\/a> resources to establish baseline defenses against such volumetric credential attacks.<\/p>\n

Some of these IP addresses may be associated with ADSL systems, frequently configured with dynamic public IP assignments.<\/p>\n

Clicking on individual IPs in the tables below provides access to Talos Intelligence<\/em> service for additional technical details.<\/p>\n

Italian IP Statistics<\/h2>\n

The volume of attack sources originating from Italy is substantial, as evidenced by the count associated with each operator to which infected devices are connected.<\/p>\n

\"\"<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
AS<\/span><\/strong> <\/span><\/i><\/th>\nASN<\/span><\/strong> <\/span><\/i><\/th>\nCNT<\/span><\/strong><\/i><\/th>\n<\/tr>\n
\n
3269<\/a><\/span><\/div>\n<\/td>\n
\n
Telecom Italia<\/span><\/div>\n<\/td>\n
416<\/span><\/td>\n<\/tr>\n
\n
30722<\/a><\/span><\/div>\n<\/td>\n
\n
\n
\n

Vodafone Italia S.p.A.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<\/td>\n

220<\/span><\/td>\n<\/tr>\n
\n
12874<\/a><\/span><\/div>\n<\/td>\n
\n
Fastweb<\/span><\/div>\n<\/td>\n
124<\/span><\/td>\n<\/tr>\n
\n
5602<\/a><\/span><\/div>\n<\/td>\n
\n
KPNQWest Italia S.p.a.<\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
20836<\/a><\/span><\/div>\n<\/td>\n
\n
CDLAN s.r.l.<\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
200689<\/a><\/span><\/div>\n<\/td>\n
\n
Teleimpianti Srl<\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
1267<\/a><\/span><\/div>\n<\/td>\n
\n
Wind Telecomunicazioni SpA<\/span><\/div>\n<\/td>\n
75<\/span><\/td>\n<\/tr>\n
\n
31034<\/a><\/span><\/div>\n<\/td>\n
\n
Aruba S.p.A.<\/span><\/div>\n<\/td>\n
46<\/span><\/td>\n<\/tr>\n
\n
28716<\/a><\/span><\/div>\n<\/td>\n
\n
Reti Telematiche Italiane S.p.A. (Retelit S.p.A.)<\/span><\/div>\n<\/td>\n
6<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Source IP<\/span> <\/span><\/i><\/th>\nCNT<\/span> <\/span><\/i><\/th>\n<\/tr>\n
\n
109.168.80.138<\/a><\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
185.98.166.23<\/a><\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
5.89.121.199<\/a><\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
5.89.22.195<\/a><\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
79.1.26.173<\/a><\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
79.32.207.186<\/a><\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
82.58.103.226<\/a><\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
87.238.24.13<\/a><\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
93.42.146.50<\/a><\/span><\/div>\n<\/td>\n
90<\/span><\/td>\n<\/tr>\n
\n
79.21.183.77<\/a><\/span><\/div>\n<\/td>\n
50<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/h2>\n

 <\/p>\n

Attack Map and Global Statistics<\/h2>\n

At the global level, the numbers are substantial. Tens of thousands of compromised devices conduct brute force attacks.<\/p>\n

\"Attack
Attack Map<\/figcaption><\/figure>\n
\"Top
Top 10 Countries<\/figcaption><\/figure>\n
\"Attacker
Attacker Reputation<\/figcaption><\/figure>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
AS<\/span> <\/span><\/i><\/th>\nASN<\/span> <\/span><\/i><\/th>\nCNT<\/span> <\/span><\/i><\/th>\n<\/tr>\n
\n
3215<\/a><\/span><\/div>\n<\/td>\n
\n
Orange<\/span><\/div>\n<\/td>\n
32 135<\/span><\/td>\n<\/tr>\n
\n
12389<\/a><\/span><\/div>\n<\/td>\n
\n
Rostelecom<\/span><\/div>\n<\/td>\n
10 618<\/span><\/td>\n<\/tr>\n
\n
49453<\/a><\/span><\/div>\n<\/td>\n
\n
Global Layer B.V.<\/span><\/div>\n<\/td>\n
5 928<\/span><\/td>\n<\/tr>\n
\n
57172<\/a><\/span><\/div>\n<\/td>\n
\n
Global Layer B.V.<\/span><\/div>\n<\/td>\n
5 120<\/span><\/td>\n<\/tr>\n
\n
4134<\/a><\/span><\/div>\n<\/td>\n
\n
No.31,Jin-rong Street<\/span><\/div>\n<\/td>\n
4 509<\/span><\/td>\n<\/tr>\n
\n
27699<\/a><\/span><\/div>\n<\/td>\n
\n
TELEF\u00d4NICA BRASIL S.A<\/span><\/div>\n<\/td>\n
3 365<\/span><\/td>\n<\/tr>\n
\n
58222<\/a><\/span><\/div>\n<\/td>\n
\n
Solar Invest UK LTD.<\/span><\/div>\n<\/td>\n
2 841<\/span><\/td>\n<\/tr>\n
\n
4837<\/a><\/span><\/div>\n<\/td>\n
\n
CHINA UNICOM China169 Backbone<\/span><\/div>\n<\/td>\n
2 292<\/span><\/td>\n<\/tr>\n
\n
45899<\/a><\/span><\/div>\n<\/td>\n
\n
VNPT Corp<\/span><\/div>\n<\/td>\n
1 213<\/span><\/td>\n<\/tr>\n
\n
22927<\/a><\/span><\/div>\n<\/td>\n
\n
Telef<\/p>\n","protected":false},"excerpt":{"rendered":"

Italian IoT devices conscripted into botnets and used as launch pads for cyber attacks: device profiles, exposure metrics and remediation considerations.<\/p>\n","protected":false},"author":1,"featured_media":333,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[10,11,12,13,57,58,3338,143,3335,3336,200,3337,334,347,348,379],"class_list":["post-308","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emerging-threats","tag-109-168-80-138","tag-14-225-3-37","tag-185-98-166-23","tag-193-251-15-253","tag-botnet","tag-brute-force","tag-default-credentials","tag-fastweb","tag-iot-security","tag-italian-devices","tag-kpnqwest","tag-network-exposure","tag-ssh","tag-telecom","tag-telnet","tag-vodafone"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=308"}],"version-history":[{"count":1,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/308\/revisions"}],"predecessor-version":[{"id":9920,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/308\/revisions\/9920"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}