The Cereals botnet, created eight years ago, exploits a security vulnerability in D-Link NAS and NVR devices to hijack them for its anime-collecting purposes. At its peak in 2015 the botnet had 10,000 vulnerable devices under its control. Unlike other botnets it does not appear that its creator was motivated by money. Cereals was not unsophisticated it patched systems in an attempt to prevent other attacks from hijacking devices it had infected, and maintained four backdoor mechanisms for accessing and controlling its nodes: SSH, RSS, a custom CGI backdoor, and the exploited vulnerability.”]
Source: https://www.bitdefender.com/blog/hotforsecurity/worlds-harmless-iot-botnet/