The botnet likely exploited security vulnerabilities in the devices or used default passwords that were not changed by users.