LZRD
LZRD is a Mirai-based botnet/malware variant. The provided content identifies LZRD as one of several botnets using Mirai malware, alongside Aisuru, Tiny Mantis, Murdoc_Botnet, and Resgod. It is referenced as a Mirai variant that initializes an XOR-encoded configuration and then connects to a command-and-control server to receive commands and trigger DDoS attacks. The content further notes that another Mirai-derived botnet, ShadowV2, is similar to the LZRD variant in its configuration handling and C2 communication, reinforcing LZRD’s characterization as an IoT-focused Mirai-family bot used for remote control and distributed denial-of-service operations. No specific threat actor attribution, infection vector, targeted industries, or standalone indicators of compromise are directly provided for LZRD itself in the supplied content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Akamai observed attacks in April targeting GeoVision devices through two OS command injection flaws - CVE-2024-6047 and CVE-2024-11120 - to download and run an ARM variant of Mirai dubbed LZRD.
Akamai observed attacks in April targeting GeoVision devices through two OS command injection flaws - CVE-2024-6047 and CVE-2024-11120 - to download and run an ARM variant of Mirai dubbed LZRD.
A now-patched critical security flaw in the Wazur Server is being exploited by threat actors to drop two different Mirai botnet variants and use them to conduct distributed denial-of-service (DDoS) attacks. Akamai, which first discovered the exploitation efforts in late March 2025, said the malicious campaign targets CVE-2025-24016 (CVSS score: 9.9), an unsafe deserialization vulnerability that allows for remote code execution on Wazuh servers.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A botnet listed as using Mirai malware.
LZRD is a Mirai-based botnet variant that uses XOR-encoded configuration and connects to a C2 server to receive DDoS attack commands. It is referenced as similar in operation to ShadowV2.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.