--- title: When the ISP Becomes the Weakest Link in the Cyberattack Kill Chain description: "Cybercriminals will use any advantage to reach their goal. Most of the time, they'll take advantage of the weakest link in the cyberattack kill chain: the people. But sometimes, that weak link is formed by ISPs. The reason is a simple one. They don't strengthen the hardware they deploy inside people's homes, putting their own infrastructure in jeopardy." image: https://businessinsights.bitdefender.com/hubfs/displacement-2019-switch-page.jpg --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) By [**Silviu Stahie**](https://businessinsights.bitdefender.com/author/silviu-stahie) / Dec 11, 2020 # When the ISP Becomes the Weakest Link in the Cyberattack Kill Chain Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/when-the-isp-becomes-the-weakest-link-in-the-cyberattack-kill-chain&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/when-the-isp-becomes-the-weakest-link-in-the-cyberattack-kill-chain&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/when-the-isp-becomes-the-weakest-link-in-the-cyberattack-kill-chain&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/when-the-isp-becomes-the-weakest-link-in-the-cyberattack-kill-chain&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/when-the-isp-becomes-the-weakest-link-in-the-cyberattack-kill-chain&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/when-the-isp-becomes-the-weakest-link-in-the-cyberattack-kill-chain&utm_medium=social&utm_source=facebook) - People are not always the weakest link - Trickbot was hit, but it’s operators are trying to make a comeback - ISP’s devices are oftentimes unwilling participants in massive botnet networks Cybercriminals will use any advantage to reach their goal. Most of the time, they'll take advantage of the weakest link in the cyberattack kill chain: the people. But sometimes, that weak link is formed by ISPs. The reason is a simple one. They don't strengthen the hardware they deploy inside people's homes, putting their own infrastructure in jeopardy. The cyberattack kill chain is a series of linked events that starts with criminals looking for vulnerabilities and ends with a compromised device. People are usually the weakest link as they tend to open emails and attachments they shouldn't, they visit compromises websites, and simply ignore the need to keep devices and software up to date. But one way cybercriminals compromise networks is through vast botnets they design to seek and exploit existing vulnerabilities. Such exploits are often found in the numerous IoT devices in people's homes and in the routers governing the networks in smart houses.   **Trickbot is just one example of many**   The operation that shut down the command and control centers of the infamous Trickbot botnet was touted as a great success, which is at least partly true. But the whole truth is that the Trickbot operators and the botnet itself are still active. It will take a while to bounce back, but it will happen. In fact, the first signs of its return are already here. Bitdefender's security researchers [discovered updated communication mechanisms](https://labs.bitdefender.com/2020/11/trickbot-is-dead-long-live-trickbot/), a new C2 infrastructure that uses MikroTik routers and packed modules. While the botnets' targets are fully fledged endpoints (PCs, laptops etc), the command and controls use IoT devices such as routers for servers. ISPs already use MikroTik routers, so there's a good chance that some deployed routers inside an ISP's network might end up as a C2 server for Trickbot, and that should never be an option.   **Protecting the network from the inside**   It's easy to think of ISPs as just that -- an Internet service provider. But that definition no longer fully applies. The pandemic and the paradigm shift that displaced workers from offices to homes put the security burden on ISPs’ shoulders. Fortunately, solutions exist to let ISPs protect their network and businesses. Bitdefender's IoT Security Platform fits like a glove in this situation, as it can help ISPs secure their routers and network and offer security and peace of mind to their customers at the same time. Because the platform integrates with existing hardware and has a low footprint, deployment is much easier. Having Trickbot C2 servers running on your routers is bad for any ISP. A security solution that runs in the background 24/7 without affecting performance makes cybercriminals' lives much more difficult and the lives of customers much safer.   **[\[Interested? Get in touch\]](http://bitdefender.com/iot?cid=soc|iot|hubspot|Trickbot)** ### Explore More Topics - [Enterprise Security (765)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (206)](https://businessinsights.bitdefender.com/topic/threat-research) - [SMB Security (193)](https://businessinsights.bitdefender.com/topic/smb-security) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [Ransomware (172)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (139)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (136)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (136)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (127)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (121)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Threat Intelligence (82)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [IT Compliance & Regulations (75)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (59)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (55)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (47)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (39)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (24)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (10)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (5)](https://businessinsights.bitdefender.com/topic/podcast) - [AI (2)](https://businessinsights.bitdefender.com/topic/ai) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [Weak Credentials, the Bane of Cyber Security](https://businessinsights.bitdefender.com/weak-credentials-the-bane-of-cyber-security?hsLang=en-us) ### [Compliance Is Complex, Simplifying It Shouldn’t Be](https://businessinsights.bitdefender.com/compliance-is-complex-how-to-simplify?hsLang=en-us) ### [Cybertrends to Track: Weaponizing People and Tools](https://businessinsights.bitdefender.com/cybertrends-weaponizing-people-tools?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender\_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Silviu Stahie", "url" : "https://businessinsights.bitdefender.com/author/silviu-stahie" }, "dateModified" : "2020-12-11T15:13:03.849Z", "datePublished" : "2020-12-11T15:12:41.000Z", "headline" : "When the ISP Becomes the Weakest Link in the Cyberattack Kill Chain", "image" : [ "https://businessinsights.bitdefender.com/hubfs/displacement-2019-switch-page.jpg" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/when-the-isp-becomes-the-weakest-link-in-the-cyberattack-kill-chain", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```