The IoT botnet IoTroop has amassed 10,000 to 20,000 devices and has another 2 million hosts that have been identified as potential botnet nodes, according to Arbor's Security Engineering & Response Team (ASERT), which refers to the botnet as Reaper.
Although it's not clear why the 2 million hosts have not yet been absorbed into the Reaper botnet, Arbor Network's ASERT speculates that the botnet will likely be used as a booter/stresser service for China's internal DDoS-for-hire market.
Reaper contains a hint of code from the infamous IoT botnet Mirai and has the ability to launch SYN, ACK, and http floods, as well as DNS reflection/amplification attacks, according to the researchers.
Read more about Reaper here.