# When the Botnet Talks to Google and the Water Plant Talks to Nobody
The week's threat roundup reads less like a list and more like a theme: someone, or a lot of someones, leaning hard into the gap between what infrastructure *looks* like and what it *is*. A 296,000-device IoT botnet. A SharePoint exploit chain that turns collaboration software into an attack tunnel. Over a hundred water treatment systems sitting exposed to anyone with a scanner. And threaded through all of it, the same tired but persistently effective trick — pretend to be something legitimate until you aren't.
## 296,000 Compromised Devices and a Botnet That Borrows AI
The scale alone deserves a pause. A botnet operating with nearly 300,000 compromised IoT endpoints isn't a curiosity — it's a weapon platform. IoT botnets have been a fixture since Mirai dismantled large swaths of the internet in 2016, but this variant reportedly borrows AI capabilities, likely for target selection, evasion, or adaptive command-and-control behavior.
What's changed in the last decade isn't the core botnet model — it's the instrumentation. Early botnets were blunt instruments: flood traffic, crash targets. Newer architectures are patient. They scan, classify, and prioritize. They route command traffic through trusted public infrastructure — legitimate services like cloud storage, public APIs, or CDN endpoints — so network defenders looking at logs see green where they should be seeing red.
Command-and-control traffic hiding inside public infrastructure isn't new, but the sophistication of the concealment has matured fast. Discord webhooks, GitHub gists, Google Forms — these have all served as C2 staging grounds. When your outbound traffic looks identical to a developer fetching documentation, traditional signature-based detection struggles.
For defenders managing IoT-heavy environments: the question isn't whether your devices are in someone's botnet. The question is whether you'd know if they were.
## A Hundred Water Plants and One Very Bad Assumption
The water system exposure deserves more than bullet-point treatment. More than 100 water treatment facilities reportedly scanned or targeted represents a meaningful escalation in critical infrastructure reconnaissance — and "reconnaissance" is doing some heavy lifting here, because for operational technology (OT) environments, being scanned is often functionally equivalent to being attacked. These systems aren't built for it.
The Oldsmar, Florida incident in 2021 — where an attacker briefly elevated sodium hydroxide to dangerous levels via remote access — should have been the sector's forcing function. It wasn't, at least not completely. Water utilities operate on thin margins with aging equipment and IT staff measured in single digits. The threat model they were designed around was physical intrusion, not remote exploitation of internet-exposed SCADA interfaces.
What makes this week's reporting alarming isn't that water systems are being targeted — that's been true for years. It's the *volume*. Scanning 100+ facilities simultaneously suggests either automated tooling with broad targeting criteria or a coordinated campaign working a target list. Neither interpretation is reassuring.
## SharePoint's RCE Chain Problem
Microsoft SharePoint has had a rough few years. The platform — ubiquitous in enterprise environments — keeps appearing in critical infrastructure breach chains because it checks every box attackers want: widely deployed, trusted, internet-facing by design, and running in environments where defenders are stretched thin.
The RCE chain in this week's roundup fits a recognizable pattern. SharePoint vulnerabilities don't usually get exploited in isolation; they get chained. An authentication bypass leads to file write access leads to code execution. Defenders patching individual CVEs without understanding how they chain together are playing whack-a-mole.
The shrinking exploit window compounds this. Research consistently shows the gap between vulnerability disclosure and active exploitation dropping — in some cases to days, occasionally hours. If your organization runs SharePoint and you're on a monthly patch cycle, you're operating on borrowed time during that window. The answer isn't "patch faster" in isolation — it's segmentation, monitoring, and assuming your SharePoint instance is a target.
## The Deception Economy Is Still Profitable
Fake login pages. Fake security scans. Fake productivity apps.
The fact that this still works — and works well enough to anchor a weekly threat roundup — says something uncomfortable about security training programs. Organizations spend real money on phishing simulations and security awareness curricula, and the conversion rate on credential-harvesting pages remains high enough that threat actors keep building them.
Part of this is a problem with how phishing detection works in practice. Users are trained to look for visual cues — bad spelling, strange domains, missing branding. Attackers have largely solved those tells. A well-constructed fake login page, served from a compromised legitimate domain, with a valid TLS certificate, is functionally indistinguishable to the average user. The cognitive load of "is this real?" under time pressure at work is too high to reliably catch sophisticated lures.
Malicious tools waiting before revealing their behavior — delayed execution, environment checks, sleeping through sandbox analysis — are the same principle applied to endpoint detection. Don't look like malware until you're past the sensors.
---
## HackWire Analysis
The pattern across this week's stories isn't seven unrelated incidents — it's one strategic posture: appear legitimate, then act. The botnet hides in public infrastructure. The phishing page looks like IT helpdesk. The malware sleeps through the sandbox window. SharePoint, a platform users trust by design, becomes the entry point.
What's worth naming explicitly is how this converges with the critical infrastructure exposure problem. Water utilities and industrial operators don't have mature EDR stacks and 24/7 SOCs. Their threat model was built for a different era. When 296,000 IoT devices are available for tasking and a hundred water plants are sitting in someone's scan results, the intersection of those two facts is where the real risk lives — not in either story alone.
The AI-assisted botnet angle also deserves skepticism and scrutiny in equal measure. "AI-powered" is marketing language that gets attached to threat actors' tools the same way it gets attached to vendor products. What actually matters is the behavior: adaptive C2, smarter target selection, reduced noise signatures. Whether that's gradient descent or a clever lookup table doesn't change the defensive problem. The behavioral capability is what defenders need to model for.
For security teams this week: audit your internet-facing SharePoint exposure and check patch currency. If you manage OT or IoT environments, treat "could this device be in a botnet" as a live operational question, not a theoretical one. And if you're in water or energy, the sector-specific CISA advisories aren't optional reading.
The exploit window keeps shrinking. The attackers know it. The question is whether defenders are adjusting their cadence to match.
— HackWire Editorial
---
## Related Coverage