IOT-MQTT-OPENInitial Access

MQTT Broker Open / No Auth

Public MQTT broker reachable without auth on TCP/1883 — subscribe to # and read every device topic; publish to control devices.

§ Where this technique fits

IOT-MQTT-OPEN is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

Open MQTT broker → smart-estate takeover
Shodan-indexed MQTT broker on TCP/1883 with no auth. Subscribe to '#' to harvest every device topic; publish to relays/locks/lights/thermostats.
step 2 / 5

§ What commonly comes next

01
Account Discovery
T1087 · Discovery
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Open MQTT broker → smart-estate takeover

§ What commonly comes next