Owari

Owari is a Mirai-derived IoT botnet malware family associated with the threat actor known as Wicked and closely related to the Sora, Omni, and Wicked botnet lineage. It targets Internet-exposed embedded Linux devices and routers, propagating first through default-credential attacks and later through exploit-based compromise as the operator expanded beyond Mirai’s original Telnet-centric model. Owari has been observed incorporating exploitation of CVE-2017-17215 affecting Huawei devices, and reporting has linked its broader ecosystem to exploit-driven delivery chains used against vulnerable IoT infrastructure.

Like other Mirai variants, Owari is designed to compromise devices at scale, enroll them into a botnet, and support distributed denial-of-service operations. Its development reflects the broader evolution of post-Mirai botnets from simple brute-force propagation toward mixed scanning and exploitation workflows. The malware has been described as actively developed after Sora was abandoned, with additional exploit scanners added to improve growth in an increasingly saturated IoT environment where default-password compromises were becoming less effective.

Owari is part of a cluster of related malware families that share infrastructure, development patterns, and operator overlap. Security reporting has linked Owari with Omni through shared hosting and operational artifacts, and assessed that these botnets were likely developed by the same author or group. In later observations, infrastructure previously used to distribute Owari payloads was repurposed to deliver Omni, indicating iterative reuse of tooling and delivery mechanisms across successive Mirai-variant projects. Owari has also been referenced as less persistent in the active threat landscape than Sora, suggesting it was eventually superseded within the same development lineage.