IoT Hijinks: Water Barghest’s 10-Minute Cybercrime Hustle Hits 20,000 Devices!
Water Barghest, a cybercriminal group, has turned compromising IoT devices into a profitable venture by selling them as proxies on the market. With a 10-minute takeover process, this group is the Amazon Prime of cybercrime, exploiting vulnerabilities faster than you can say “internet of things.”

Hot Take:
If your toaster starts talking to your fridge, and it’s not about the weather, you might just have a Water Barghest situation on your hands. Welcome to the future, folks, where your Wi-Fi router moonlights on the dark web and makes more money than you do!
Key Points:
- Cybercriminal group “Water Barghest” exploits IoT devices, selling them on residential proxy marketplaces.
- Over 20,000 IoT devices, including SOHO routers, have been compromised using automated scripts.
- Ngioweb malware is used to register these devices as proxies for sale to other threat actors.
- Automation allows Water Barghest to quickly and efficiently compromise devices in about 10 minutes.
- Trend Micro suggests mitigating exposure of IoT devices to the open Internet to prevent exploitation.
Already a member? Log in here