Loading malware…
Mirai is a Linux-based botnet malware family that compromises internet-connected devices, particularly routers, surveillance cameras, and digital video recorders, and recruits them for distributed denial-of-service (DDoS) attacks. The original malware scans for accessible devices and attempts authentication using factory-default username and password combinations. Compromised devices become remotely controlled attack infrastructure capable of overwhelming targeted services with traffic. On October 21, 2016, a Mirai botnet attacked DNS provider Dyn, disrupting access to major online services.
The original Mirai infection resided in volatile memory and did not survive a reboot, although devices remained susceptible to reinfection until their exposed services and weak credentials were addressed. Subsequent variants expanded beyond default-credential attacks to exploit vulnerabilities in internet-facing devices. Observed campaigns delivered Mirai by chaining the authentication bypass CVE-2023-46805 with the command-injection vulnerability CVE-2024-21887 in Ivanti Connect Secure and Ivanti Policy Secure gateways. Some variants have also incorporated cryptocurrency-mining functionality. Mirai and its descendants turn both consumer IoT devices and enterprise network appliances into distributed attack infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
36 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Attackers exploit the CVE-2023-46805 vulnerability to gain access to this endpoint and inject their payload ... More recently, we have encountered Mirai payloads delivered through shell scripts. | Juniper Threat Labs obtained and analyzed the payloads and identified them as Mirai botnets.
Ivanti reported two vulnerabilities, CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways. | Juniper Threat Labs obtained and analyzed the payloads and identified them as Mirai botnets.
Table 1 lists Huawei CVE-2017-17215 as a router command-injection vulnerability, with AV labels gafgyt, ircbot, mirai, and tsunami. | The initial version of the Mirai botnet focused on DDoS and scanning capabilities.
Table 1 lists GPON CVE-2018-10562 as a router command-injection vulnerability, with AV labels gafgyt, mirai, and tsunami. | The initial version of the Mirai botnet focused on DDoS and scanning capabilities.
Table 1 lists Zyxel CVE-2017-18368 as a router command-injection vulnerability, with AV labels gafgyt and mirai. | The initial version of the Mirai botnet focused on DDoS and scanning capabilities.
Table 1 lists Synology CVE-2017-9554 as a NAS information-leak vulnerability, with AV labels gafgyt, intercepter, minerd, mirai, stealthworker, and xmrig. | The initial version of the Mirai botnet focused on DDoS and scanning capabilities.
Table 1 lists Juniper CVE-2015-7756 as a firewall backdoor vulnerability, with AV labels gafgyt and mirai. | The initial version of the Mirai botnet focused on DDoS and scanning capabilities.
Table 1 lists D-Link CVE-2013-7471 as a router command-injection vulnerability, with AV labels gafgyt, mirai, and tsunami. | The initial version of the Mirai botnet focused on DDoS and scanning capabilities.
Table 1 lists D-Link CVE-2014-8361 as a router command-injection vulnerability, with AV labels gafgyt, mirai, and tsunami. | The initial version of the Mirai botnet focused on DDoS and scanning capabilities.
Table 1 lists Zyxel CVE-2016-10372 as a modem command-injection vulnerability, with AV labels gafgyt, mirai, and tsunami. | The initial version of the Mirai botnet focused on DDoS and scanning capabilities.
Aside from targeting the Wazuh RCE, we observed this botnet attempting to exploit a variety of other known vulnerabilities. Figure 6: TP-Link Archer AX21 command injection. | “We observed two campaigns of Mirai variants exploiting this vulnerability.”
The Akamai Security Intelligence and Response Team (SIRT) has identified active exploitation of the critical remote code execution (RCE) vulnerability CVE-2025-24016 against Wazuh servers (CVSS 9.9). | “We observed two campaigns of Mirai variants exploiting this vulnerability.”
In early December 2022, a security advisory warned of a critical command injection vulnerability (tracked as CVE-2022-46169, severity rating 9.8 out of 10) in Cacti that could be exploited without authentication.
GeoServer의 원격 코드 실행 취약점(CVE-2024-36401)이 공개된 이후 최근까지도 해당 취약점을 악용해 악성코드를 설치하는 사례들이 확인되고 있다.
The SIRT uncovered a vulnerability in FXC AE1021 and AE1021PE outlet wall routers that are being actively exploited in the wild. The vulnerability allows an authenticated attacker to achieve OS command injection with a payload delivered via a POST request to the management interface.
Home Network Administration Protocol (HNAP) SOAPAction-header command execution vulnerability that works on certain D-Link devices.
Vulnerability that can allow the execution of remote arbitrary commands in Netgear R7000 and R6400 devices.
BYTEVALUE Intelligent Flow Control Router contains a command injection vulnerability via the /goform/webRead/open endpoint. The `path` parameter is not properly validated and is echoed into a shell context, allowing an attacker to inject and execute arbitrary shell commands on the device. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign.
CVE-2024-7029 is a command injection vulnerability found in the brightness function of AVTECH closed-circuit television (CCTV) cameras that allows for remote code execution (RCE).
During routine sandbox hunting analysis, the Uptycs Threat Research team uncovered evidence of an ongoing live campaign exploiting the Log4j vulnerability, which commenced in January 2024.
CVE-2018-10561, CVE-2018-10562: Authentication bypass and command injection vulnerabilities, respectively, for the Dasan gigabit passive optical network (GPON) routers.
We observed Dark IoT botnet samples targeting vulnerabilities from 2021, CVE-2021-20090 / CVE-2021-20091 and CVE-2021-35395.
It observed multiple remote command execution attempts "by a Mirai-like botnet" and advised owners of affected Zyxel NAS devices to actively search for signs of compromise, especially if the patches weren't applied immediately.
In June 2023, FortiGuard Labs detected the propagation of several DDoS botnets exploiting the Zyxel vulnerability (CVE-2023-28771). These attacks specifically target the command injection vulnerability in the Internet Key Exchange (IKE) packet transmitted over UDP on Zyxel devices.
CVE-2021-20090 / CVE-2021-20091 — Path traversal vulnerability and Configuration File Injection
It was published 16th August and we already saw samples leveraging it on the 20th.
This botnet has also been observed exploiting CVE-2024-7214, which affects TOTOLINK IoT devices.
The most notable of these vulnerabilities is CVE-2020-10173, a Multiple Authenticated Command injection vulnerability found in Comtrend VR-3033 routers.
We observed Dark IoT botnet samples targeting vulnerabilities from 2021 ... along with an old one from 2014, CVE-2014-3206.
“The default creds for the DVR device were root/zlxx. – including the full stop.” The article links this credential issue to “an old CVE for various Unix distros: CVE-1999-0502.”
On June 2, Atlassian published an advisory for CVE-2022-26134, a critical zero-day remote code execution vulnerability in Confluence Server and Data Center.
The exploit targets the /camera-cgi/admin/param.cgi endpoint in Edimax devices, and injects commands into the NTP_serverName option as part of the ipcamSource option of param.cgi. This exploit requires authentication, and all the exploit attempts we observed were passing default credentials; typically admin:1234.
“Ubiquiti published security advisory SAB-064 on 21 May 2026 addressing CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. Each vulnerability was assigned a CVSS score of 10.0 and, when chained, could allow an unauthenticated remote attacker to obtain root-level access to affected UniFi systems.”
“That mismatch is CVE-2026-34908 (broken access control) and CVE-2026-34909 (path traversal), the pair Ubiquiti describes in SAB-064.”
“A URL that starts with the public prefix /api/auth/validate-sso/ but contains encoded ../ sequences passes the gateway's public check, then decodes into a protected /proxy/<service>/… path and reaches the backend with no authentication.”
This botnet has also been observed targeting various other vulnerabilities in our network of honeypots, including a Docker API endpoint exploit. In addition, they also have targeted CVE-2021-36220, and a Hadoop YARN vulnerability.
15 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Integrity Tech built and ran a botnet made up of infected Internet of Things (IoT) devices running a version of the Mirai malware.”
Court documents allege that Integrity Tech created and operated an IoT botnet that leveraged a variant of the Mirai malware.
Analysis of the Scar rental botnet confirmed that the group contains not only the new botnet family found this time, but also other botnet families Mirai and Moobot.
Mirai spreads by scanning for Internet-facing IoT devices and brute-forcing default credentials.
EnemyBot is mainly built on Gafgyt’s source code, with several modules from the original Mirai source code, and other botnets.
“Some of the key players are Mirai Botnet ... Passion Botnet ... Tesla-Botnet ... MistNet ... SkyNet Botnet ... and Godzilla-BotNet.”
26 distinct techniques documented for this family, organized by ATT&CK tactic.
The observed traffic focused on port 23, commonly used by Telnet... Mirai families have repeatedly abused weak credentials and reachable remote services.
“By leveraging the UPX executable packer, threat actors can avoid standard heuristic detection methodologies.”
HTTP/S was used for panel APIs, JS staging, challenge/response traffic, and ClickFix command retrieval.
Les attaquants recourent massivement aux réseaux proxy résidentiels... Une connexion sortante chiffrée et persistante vers un serveur proxy est maintenue.
2,567 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Compromises IoT devices using factory-default credentials and recruits them into attack infrastructure. The article links Mirai to the October 2016 attack against DNS provider Dyn and notes extensive reuse of its published source code.
Mentioned only as a ThreatFox label associated with an IP address observed attempting exploitation. This enrichment does not establish that Mirai was deployed in the observed attacks or that it is related to the other named payloads.
Compromises connected devices and recruits them into botnets used for DDoS attacks. Mentioned as background illustrating existing IoT threats, not as evidence of autonomous AI replication.
Recruits connected devices into botnets that launch DDoS attacks. Mentioned as background illustrating existing criminal abuse of IoT devices, not as evidence of autonomous AI replication.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.