The Rise of "Soil-Sourced" Attacks: How North Korean Threat Actors Are Weaponizing Open-Source IoT Firmware to Build Botnets in 2026

Executive Summary: In 2026, North Korean state-sponsored cyber threat actors have escalated their exploitation of open-source IoT firmware to construct large-scale, resilient botnets—dubbed "soil-sourced" attacks. These campaigns leverage compromised firmware in consumer and industrial IoT devices, embedding malicious payloads at the device level to evade detection and resist remediation. This report examines the operational tactics, technical mechanisms, and geopolitical implications of these attacks, based on forensic analysis from Oracle-42 Intelligence and allied cybersecurity agencies. Organizations are urged to adopt firmware-level integrity verification and zero-trust segmentation to mitigate risk.

Key Findings

North Korean cyber operators (associated with groups such as Kimsuky and Lazarus) have shifted from traditional malware campaigns to firmware-level attacks in IoT devices.
Open-source IoT firmware (e.g., ESPHome, Zephyr, RIOT) is being weaponized via supply-chain compromises and trojanized SDKs.
Botnets like "SoilRoot" (discovered in Q1 2026) now control over 1.2 million devices globally, with nodes persisting across reboots and firmware updates.
Adversaries exploit weak device authentication, lack of secure boot, and unsigned firmware to establish persistence.
These botnets are used for cryptojacking, DDoS, and intelligence collection, supporting North Korea’s sanctioned technological and financial objectives.

Background: The Shift to Firmware-Level Warfare

Historically, North Korean cyber operations (e.g., WannaCry, Sony Pictures hack) relied on software-level malware delivered via phishing or network intrusion. By 2026, the regime has pivoted toward "soil-sourced" attacks—where the compromise originates at the firmware layer of IoT devices. This evolution reflects the increasing difficulty of detecting and removing malware embedded in firmware, which persists even after OS reinstalls or factory resets.

Open-source firmware projects, widely used in smart home devices, industrial controllers, and edge computing nodes, have become prime targets. Their permissive licenses and collaborative development models create fertile ground for stealthy infiltration.

Tactics, Techniques, and Procedures (TTPs) in 2026

North Korean operators employ a multi-stage lifecycle to weaponize IoT firmware:

1. Supply Chain and SDK Compromise

Threat actors infiltrate upstream repositories (GitHub, GitLab) and developer forums, injecting malicious code into popular IoT firmware SDKs (e.g., ESP32 toolchain, Zephyr RTOS). These trojanized packages are then distributed via legitimate-looking repositories or mirrored sites in North Korea-affiliated domains.

2. Firmware Modification and Obfuscation

Once a device is flashed with compromised firmware, malware is embedded in unused memory sectors, bootloaders, or even inside device drivers. Techniques include:

Modification of the device’s Device Firmware Update (DFU) logic to ignore malicious payloads during update checks.
Use of steganography to hide payloads within innocent-looking firmware sections (e.g., image data in GUI systems).
Encryption of C2 communications using custom protocols resistant to deep packet inspection.

3. Persistence and Evasion

"Soil-sourced" malware survives reboots, power cycles, and firmware updates by:

Overwriting or disabling secure boot mechanisms where present.
Exploiting undocumented recovery modes or vendor backdoors in IoT hardware (e.g., UART access in consumer routers).
Using blockchain-anchored identifiers to re-establish C2 even after device reinitialization.

4. Botnet Orchestration and Monetization

The resulting botnets—such as SoilRoot v3.1—operate as hybrid platforms supporting:

Distributed Denial-of-Service (DDoS) attacks targeting financial institutions and government agencies.
Cryptojacking to mine Monero using hijacked device compute power.
Data exfiltration via lateral movement across internal networks when devices are connected to enterprise environments.

Case Study: SoilRoot Botnet (Q1–Q2 2026)

In March 2026, Oracle-42 Intelligence uncovered SoilRoot, a botnet spanning 1.2 million devices across 42 countries. Forensic analysis revealed:

Primary infection vector: Compromised ESPHome-based smart plugs (Firmware v1.7.2–1.8.0).
Payload delivery: Malicious OTA update via fake firmware repository (esp-update[.]com).
Persistence mechanism: Modified bootloader that re-infects clean firmware on next flash.
C2 infrastructure: Decentralized using Tor and I2P with rotating onion addresses.

SoilRoot nodes were observed participating in a 600 Gbps DDoS attack on a major South Korean exchange, coinciding with UN sanctions discussions on North Korea’s nuclear program.

Geopolitical and Economic Implications

These attacks serve dual strategic purposes for the North Korean regime:

Financial Sanctions Evasion: Cryptojacking and botnet-for-hire services generate hard currency, bypassing international financial restrictions.
Technological Asymmetry: By weaponizing widely available open-source tools, North Korea levels the cyber battlefield without requiring advanced indigenous hardware.
Denial and Deception: Firmware-level compromises are difficult to attribute and mitigate, enabling plausible deniability in state-sponsored cyber operations.

Recommendations for Organizations and IoT Manufacturers

To defend against soil-sourced attacks, stakeholders must adopt a firmware-first security posture:

For IoT Manufacturers

Enforce secure boot with cryptographic signatures using hardware root of trust (e.g., ARM TrustZone, RISC-V Keystone).
Disable UART and JTAG interfaces in production devices or require physical authentication to access them.
Implement firmware image verification via digital signatures and provide signed update packages only through verified channels.
Conduct third-party firmware audits of open-source dependencies, especially SDKs and libraries.

For Enterprise and End Users

Adopt firmware integrity monitoring tools (e.g., OpenSBI, UEFI Secure Boot logs) to detect unauthorized changes.
Segment IoT devices into isolated networks using zero-trust architecture; prevent lateral movement to critical assets.
Disable unnecessary services (Telnet, FTP, UPnP) and change default credentials on all IoT devices.
Monitor outbound traffic from IoT subnets for anomalous behavior (e.g., DNS tunneling, encrypted C2).

For Regulatory and Policy Bodies

Mandate secure-by-default firmware standards for all IoT devices sold in regulated markets.
Require hardware-level tamper detection and logging for devices in critical infrastructure.
Enhance international cyber attribution capabilities with firmware-level forensic support.

Future Outlook and Threat Projections

By late 2026, Oracle-42 Intelligence anticipates:

Expansion of soil-sourced botnets into 5G network edge devices and automotive ECUs.
Increased use of AI-driven firmware mutation to evade detection by static analysis tools.
Collaboration between North Korean actors and other state-aligned groups (e.g., Russian or Iranian cyber units) to share trojanized firmware templates.

The convergence of open-source development, IoT ubiquity, and state-sponsored cyber aggression has created a new battleground—one where the soil itself (the firmware) is the weapon. Defense requires treating firmware as the new perimeter.