Security Experts:

Connect with us

Hi, what are you looking for?



LED Light Control Console Abused to Spew Malware

Even seemingly insignificant Internet of Things (IoT) devices such as LED light control consoles can be abused to launch malicious attacks, Microsoft’s security researchers warn.

Even seemingly insignificant Internet of Things (IoT) devices such as LED light control consoles can be abused to launch malicious attacks, Microsoft’s security researchers warn.

Proof of that comes from an incident uncovered in Taiwan, where such a device was used to spew malware as part of an operation that leveraged a botnet of IoT products to distribute malware and ransomware, send phishing emails, and launch distributed denial-of-service (DDoS) attacks.

Looking into suspicious activity that showed an increase in botnet signals of 100 times within a month, Microsoft’s security researchers identified a cluster of activity where as much as one terabyte (TB) of malicious content was being sent out over the course of a single week.

After mapping the malicious activity to over 400,000 publicly available IP addresses, the researchers were able to narrow the investigation to only 90 suspicious IPs, but found that one of them alone was responsible for a large amount of malicious activity.

“One particular IP was associated with dozens of activities related to the distribution of malware, phishing emails, ransomware, and DDoS attacks,” Microsoft says.

Microsoft alerted Taiwan’s Ministry of Justice Investigation Bureau (MJIB), which was able to identify the illegal VPN IP, along with hidden accounts that were leveraging the VPN to send malware attacks from inside an office building in rural northern Taiwan.

The source of the attacks, an LED light control console, was shut down to prevent the spreading of malware.

“This case marks a milestone. That’s because we were able to take down the IoT device and secure the breach to a limited range for those compromised computers in Taiwan, which is quite different from our previous global cooperation cases,” Director Fu-Mei Wu, who leads the MJIB’s Information and Communication Security Division, commented.

The large number of mobile and IoT devices connected to the Internet over the past several years has exposed users worldwide to a variety of new types of cybercrime.

Hackers leverage insecure IoT devices to steal users’ credentials and financial information, to perform cyber-espionage, knock servers offline via DDoS attacks, disrupt critical infrastructure systems, or encrypt victims’ data and hold it for ransom.

“The MJIB is busy with cases of computer intrusions and cyberattacks, with the trend increasing over the last two years. These hackers are targeting the government and the technology industry, trying to steal and leak confidential information and launch full information warfare campaigns,” Microsoft notes.

Related: Potent ‘dark_nexus’ IoT Botnet Emerges

Related: Tech Companies Partner to Securely Connect IoT to Cloud

Related: IoT Devices at Major Manufacturers Infected With Malware via Supply Chain Attack

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack


Artificial intelligence is competing in another endeavor once limited to humans — creating propaganda and disinformation.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.


A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.