Owari

Owari is a Mirai-derived IoT botnet that emerged in late 2017 and is associated with the threat actor known as Wicked, who also claimed involvement in the SORA botnet and was later linked to Omni and the exploit-driven WICKED propagation component. Like other Mirai descendants, Owari targets internet-exposed embedded Linux devices and routers, enrolling compromised systems into a botnet primarily used for distributed denial-of-service operations and related botnet-for-hire activity.

Early Owari activity relied on Mirai-style Telnet attacks using default or weak credentials against exposed IoT devices. As the pool of easily brute-forced devices became more saturated, Owari evolved to incorporate exploit-based propagation. High-confidence reporting links Owari to exploitation of Huawei HG532 devices via CVE-2017-17215, and related infrastructure overlaps tie it closely to Omni campaigns exploiting GPON routers via CVE-2018-10561. Owari has also been delivered through the WICKED malware component, which scans for vulnerable IoT and edge devices and uses known remote code execution and command injection flaws to fetch and execute Owari payloads.

Consistent with Mirai lineage, Owari is part of the broader ecosystem of self-propagating IoT malware that compromises devices across multiple CPU architectures, uses automated scanning and credential attacks or exploits for initial access, and incorporates botkiller behavior to remove competing malware from infected hosts. The malware family is tied to commercially motivated operations in which botnet capacity was reportedly rented to stresser services. Owari is generally discussed as one of several successive Mirai-variant projects developed in the same operator milieu as SORA, Wicked, and Omni, reflecting the post-Mirai trend from simple default-password compromise toward faster exploit-assisted propagation against unpatched IoT infrastructure.