Omni

Omni is a Mirai-derived IoT botnet malware family active since 2018 that targets embedded Linux devices, especially internet-exposed routers and similar appliances. It has been observed exploiting Dasan GPON router vulnerabilities including CVE-2018-10561 and CVE-2018-10562, and later evolving into broader exploit-based propagation against multiple classes of IoT equipment such as routers, DVRs, NVRs, and IP cameras. Reported Omni campaigns incorporated numerous publicly known remote code execution and command injection flaws in a single sample, reflecting rapid operationalization of newly disclosed vulnerabilities.

Omni infections have been described as using staged command execution to download, permission, and run Mirai-style binaries compiled for multiple processor architectures. Unlike the original Mirai model centered on credential brute forcing, Omni has been specifically characterized in observed campaigns as relying on exploit-based propagation. Samples have also been reported to modify local firewall rules on compromised devices to hinder reinfection by competing malware. As a Mirai-family bot, Omni is associated with botnet operation and distributed denial-of-service capability, although the supplied facts most directly support its role as exploit-propagating IoT bot malware.

Omni has been linked through shared infrastructure and development lineage to other Mirai-related botnets including Owari, Sora, and Wicked. Multiple analyses assessed these families as closely related and likely operated by the same author or development cluster, with Wicked infrastructure at one stage repurposed to deliver Owari and later Omni payloads. Omni has also been cited as one of several Mirai-era variants that became less prominent over time relative to surviving families such as SORA.