Malware

Sora

Sora is a Mirai-derived IoT/Linux botnet malware family. Reporting describes it as a Mirai strain first observed at the start of the year in earlier coverage, with naming on MalwareBazaar traced back to at least August 2024. Sora retains Mirai’s core botnet and DDoS-for-hire functionality, including decoded command support for floods such as UDP, SYN, ACK, and GRE, along with scanner configuration, credential brute-force lists, and self-propagation logic.

Sora has been associated with broad multi-architecture targeting of Linux and embedded devices. Researchers reported variants compiled to run across many CPU architectures, and newer samples were said to execute on Android and Debian as well. One infection routine attempted SSH password guessing and then downloaded multiple platform-specific Sora binaries until one matched the victim device. A March 2026 campaign used a Mirai-variant dropper script, ohshit.sh, to fetch architecture-specific payloads from 45[.]141[.]26[.]73/bins/sora.* using wget and curl, rename the payload to "Chaotic," mark it executable, and run it. The exposed server hosted 14 UPX-packed ELF binaries targeting 15 architectures, with the dropper attempting execution from locations including /tmp, /var/run, /mnt, /root, or /.

Sora is linked in reporting to the actor or developer pseudonym "Wicked." FortiGuard assessed that Wicked, Sora, Owari, and Omni were likely created by the same author, and that the WICKED loader malware was originally meant to deliver Sora before being repurposed to support later projects including Owari and Omni. Separate reporting stated that the original Sora author known as Wicked later shifted development to Owari and described Sora as abandoned, although other actors appear to have continued improving the codebase.

Detection and naming overlap with other Mirai/Gafgyt-derived activity. Fortinet stated that related malware was detected as ELF/Gafgyt.SORA!tr, ELF/Gafgyt.C0MOX!tr, ELF/Mirai.EGX!tr, and Python/Gafgyt.C0MOX!tr. Reporting also noted that competing malware families explicitly hunt for and kill processes linked to the Sora botnet family, indicating Sora’s presence in the Linux/IoT botnet ecosystem.

High-confidence indicators mentioned in the content include the dropper ohshit.sh; distribution infrastructure at 45[.]141[.]26[.]73; URLs hxxp://45[.]141[.]26[.]73/ohshit[.]sh and hxxp://45[.]141[.]26[.]73/bins/sora.*; the process masquerade name "Chaotic" used in one 2026 campaign; and the string "SoraLOADER" referenced in analysis of the WICKED propagation component.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1585.001Social Media AccountsEvidence1

They were producing AI-generated videos of protests that never happened... Sometimes they will leave the AI watermarks for Sora or for Gemini's creation generator of videos. Sometimes even TikTok had those labels marking that it was AI.

Initial Access

2 techniques

T1078.001Default AccountsEvidence1

MITRE ATT&CK Technique ID Application Exploit Public-Facing Application T1190 IoT device exploitation Valid Accounts: Default Credentials T1078.001 Telnet/SSH brute-force

T1190Exploit Public-Facing ApplicationEvidence1

MITRE ATT&CK Technique ID Application Exploit Public-Facing Application T1190 IoT device exploitation

Execution

2 techniques

T1059.004Unix ShellEvidence1

MITRE ATT&CK Technique ID ... Unix Shell T1059.004 ohshit.sh bash dropper

T1203Exploitation for Client ExecutionEvidence1

The original Mirai used traditional brute force attempts to gain access to IOT devices. The WICKED bot, on the other hand, uses known and available exploits, with many of them already being quite old.

Persistence

1 technique

T1078.001Default AccountsEvidence1

MITRE ATT&CK Technique ID Application Exploit Public-Facing Application T1190 IoT device exploitation Valid Accounts: Default Credentials T1078.001 Telnet/SSH brute-force

Privilege Escalation

1 technique

T1078.001Default AccountsEvidence1

MITRE ATT&CK Technique ID Application Exploit Public-Facing Application T1190 IoT device exploitation Valid Accounts: Default Credentials T1078.001 Telnet/SSH brute-force

Stealth

5 techniques

T1027.002Software PackingEvidence1

UPX 3.94 packed, statically linked, section headers stripped -- standard Mirai anti-analysis

T1036MasqueradingEvidence1

AI generated content and videos that had to do with protests... protests that didn't happen or that were not real content of existing protests... coverage of current events need to be authentic in that sense.

T1036.003Rename Legitimate UtilitiesEvidence1

cat sora.< arch > >Chaotic; chmod +x *; ./Chaotic ... MITRE ATT&CK Technique ID ... Masquerading T1036.003 Binary renamed to "Chaotic"

T1078.001Default AccountsEvidence1

MITRE ATT&CK Technique ID Application Exploit Public-Facing Application T1190 IoT device exploitation Valid Accounts: Default Credentials T1078.001 Telnet/SSH brute-force

T1218System Binary Proxy ExecutionEvidence1

The thing that stood out about this new Sora version was that the malware author compiled it with Aboriginal Linux, a toolchain utility that takes source code and generates binaries for a considerable number of platforms.

Credential Access

1 technique

T1110Brute ForceEvidence1

Once he'd access a device by guessing its SSH password, the infection routine would download and execute a list of Sora binaries, one by one, until it would found one appropriate for the infected device's platform.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

the infection routine would download and execute a list of Sora binaries, one by one, until it would found one appropriate for the infected device's platform.

Impact

1 technique

T1498Network Denial of ServiceEvidence1

These include standard Mirai DDoS commands (UDP flood, SYN flood, ACK flood, GRE flood) ... MITRE ATT&CK Technique ID ... Network Denial of Service T1498 Mirai DDoS capability

INDICATORS OF COMPROMISE

IOCs tracked for this family

10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 month ago

hash.sha256●●●●●●●●●●●●View more in app4 months ago

ip.v4●●●●●●●●●●●●View more in app4 months ago

uri●●●●●●●●●●●●View more in app4 months ago

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

fortinet threat research blogNews

Jun 3, 2026

Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO | FortiGuard Labs

Referenced only as a FortiGuard detection name for a Gafgyt-related sample; no additional details are provided in the content.

cyber security newsNews

Mar 17, 2026

New CondiBot Variant and ‘Monaco’ Cryptominer Expand Threats to Network Devices

A botnet family referenced as a competing malware process that CondiBot attempts to kill on infected machines.

breakglass intelNews

Mar 12, 2026

ohshit.sh: Inside a Sora/Mirai Botnet Dropper Targeting 15 CPU Architectures From an Open Directory in Thailand - Breakglass Intelligence - Breakglass Intelligence

Sora is described as a Mirai-variant botnet payload distributed by the ohshit.sh shell dropper. It targets a wide range of Linux/IoT CPU architectures, downloads and executes architecture-specific ELF binaries, uses UPX packing and stripped sections for anti-analysis, and retains Mirai-style DDoS, scanning, credential brute-force, and self-propagation capabilities. The binaries are renamed and executed as "Chaotic."

bleeping computerNews

Aug 23, 2018

Mirai IoT Malware Uses Aboriginal Linux to Target Multiple Platforms

Sora is a Mirai strain whose newer variants were improved to run across many architectures using Aboriginal Linux-built binaries, including successful execution on Android and Debian, and spread by guessing SSH passwords and trying multiple binaries until one matches the victim platform.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching10

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Sora