Mirai
Mirai is an Internet-of-Things botnet malware family best known for compromising insecure IoT devices and using them to conduct large-scale distributed denial-of-service attacks. The provided content states that Mirai was used in major DDoS attacks, including a 620 Gbps attack against KrebsOnSecurity, and that its source code was apparently released on GitHub by the actor "Anna-senpai," lowering the barrier to entry for follow-on variants and operators. Mirai is described as compact C malware targeting IP cameras and other Internet-connected devices, attempting compromise via hardcoded root passwords, infecting devices, and directing them to send traffic to preset targets. The content notes claims that the botnet previously controlled up to 380,000 bots via Telnet, later declining after ISP remediation efforts. The content also shows Mirai as an active and persistent botnet ecosystem rather than a single static malware sample. Cisco Talos observed Mirai exploiting Log4j, and Trend Micro’s Zero Day Initiative reported Mirai-associated threat actors exploiting CVE-2023-1389 in TP-Link Archer AX-21 routers since April 11, 2023. Akamai reported active exploitation of CVE-2025-29635, a command injection flaw in discontinued D-Link DIR-823X routers, to deploy a Mirai variant named "tuxnokill," fetched from 88.214.20[.]14 and communicating with command-and-control server 64.89.161[.]130:44300. The same actor was also reported exploiting CVE-2023-1389 and a remote code execution flaw in ZTE ZXV10 H108L routers. The content further notes that Mirai variants have targeted game servers using Valve Source Engine-related attack modules and that Mirai botnet variants have historically abused ports 27015 and 27016. Across the supplied reporting, Mirai is repeatedly associated with exploitation of publicly known vulnerabilities in exposed edge devices and with broad botnet activity against routinely exploited vulnerabilities. CISA-related reporting cited Mirai as the most active botnet among those exploiting top routinely exploited vulnerabilities in 2022, and Log4Shell was identified as the most commonly used vulnerability by tracked botnets including Mirai. No nation-state attribution is established in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet activity exploiting vulnerable legacy routers to deploy Mirai variants and compromise devices for botnet operations.
Referenced as a botnet family/operator contextually associated with targeting game servers and abusing Valve Source Engine infrastructure.
Mirai is a botnet that exploited several of the top twelve most exploited vulnerabilities in 2022, primarily for DDoS attacks and botnet propagation.
Mirai-associated actors are exploiting CVE-2023-1389 (TP-Link Archer AX-21 command injection) to remotely execute malware; the content also notes many KEV-missing vulnerabilities are tied to Mirai-like botnet exploitation.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.