Loading story…
Researchers reported renewed activity from the Mirai-derived Sora malware and linked its development to the same actor behind the Owari IoT botnet. Symantec and NewSky Security said newer Sora samples were built with Aboriginal Linux, letting operators compile binaries for many processor architectures and even target Android devices. The malware was observed attempting broad infections after gaining access through guessed SSH passwords, while overall Mirai activity was said to be rising as unpatched and outdated IoT devices remained exposed.
NewSky Security identified an actor known as Wicked as tied to both Sora and Owari through forum monitoring, honeypots, and infrastructure analysis. In an interview, Wicked claimed Sora had been abandoned while Owari was still being developed, shifting beyond default-credential attacks to exploit-based propagation, including abuse of Huawei flaw CVE-2017-17215. The actor also described using a Telnet honeypot to study rival malware and build botkiller features, while monetizing access by renting botnet capacity to DDoS-for-hire stresser services.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
Symantec said an improved Sora variant compiled with Aboriginal Linux had been active since July 2018. The malware attempted SSH password guessing and then downloaded multiple binaries until one matched the victim device architecture.
Ankit Anubhav of NewSky Security said detections of Sora had been steadily increasing since June 2018. This indicated renewed activity around the Mirai-derived malware family.
During the April 2018 interview, Wicked said he had abandoned SORA and would continue development on OWARI instead. He also said multiple unnamed individuals besides himself had access to SORA servers.
NewSky Security published an interview in which Wicked claimed he and an associate authored the SORA and OWARI botnets. The company said its monitoring and honeypot analysis linked Wicked to the botnets' infrastructure.
By August 2018, researchers said Mirai activity had been increasing throughout the year, with Sora among the variants resurging. Troy Mursch attributed continued infections to outdated and unpatched IoT devices that become vulnerable again after reboot.
Researchers said the Sora Mirai variant was first spotted at the start of 2018. Early versions were described as unremarkable compared with other Mirai variants.
Symantec published findings on an improved Sora variant built with Aboriginal Linux, enabling broad multi-architecture targeting. Researchers said the malware could successfully execute on Android and Debian, expanding beyond platforms Mirai had not previously infected successfully.
NewSky Security said its honeypots observed an evolved OWARI variant using the Huawei CVE-2017-17215 exploit. Wicked confirmed the exploit scanner had been added only recently as operators shifted beyond default-password attacks.
In NewSky Security's April 2018 interview, Wicked said he had started the OWARI botnet about six months earlier. He described OWARI as an actively developed successor while SORA was more recent.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceblog.newskysecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and later federal prosecutors tied the Mirai-derived **Satori/Masuta** botnet activity to the alias **Nexus Zeta**, identified in court reporting as Kenneth Currin Schuchman. Security reporting said Satori rapidly infected hundreds of thousands of IoT devices by exploiting router flaws rather than relying only on default credentials, including `CVE-2017-17215` in Huawei gateways, `CVE-2014-8361` in Realtek UPNP SOAP interfaces, and a D-Link HNAP injection issue used by the **PureMasuta** branch. NewSky linked **Masuta** and **PureMasuta** to the same operator through shared command-and-control infrastructure and leaked source code, while investigators said operational security mistakes connected the botnet’s online persona to a real-world suspect. The malware family continued to evolve after initial disruption efforts. A successor dubbed **Satori.Coin.Robber** targeted exposed Claymore Miner management interfaces on port `3333` to redirect Ethereum mining rewards by changing pool and wallet settings, while still scanning for vulnerable devices on ports `37215` and `52869`. Later technical analysis showed Satori broadened support for additional processor architectures, including **superh** and **ARC**, making it one of the first known ARC-targeting malware families and underscoring how Mirai-style botnets were shifting toward exploit-driven propagation, persistent command-and-control, and large-scale DDoS capability across insecure embedded devices.
Aug 15, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
The **Mirai** malware turned insecure internet-connected devices into massive DDoS botnets that powered some of the largest attacks publicly reported, including floods against **OVH**, **KrebsOnSecurity**, and DNS provider **Dyn**. The botnet spread by logging into exposed IoT devices such as cameras, DVRs, routers, and gateways with hardcoded or default credentials, and defenders later warned that products including certain **Sierra Wireless AirLink** gateways could be conscripted if factory passwords were left unchanged. After the malware’s source code was released publicly under the alias **"Anna-senpai"**, multiple actors were able to build copycat botnets, increasing attack volume and complicating attribution. The Dyn attack disrupted access to major online services including **Twitter, Spotify, Reddit, GitHub, Airbnb, Shopify, SoundCloud, and The New York Times**, with Dyn describing a highly distributed, adaptive campaign delivered in several waves from vast numbers of IP addresses. Investigative reporting tied Mirai’s origins to the DDoS-for-hire and Minecraft-hosting ecosystem and presented evidence linking the **Anna-senpai** persona to **Paras Jha** and associates, while later reporting showed Mirai variants continued launching attacks long after the original incidents. Researchers identified limited countermeasures, including crashing some bots via a flaw in Mirai’s HTTP flood code and traceback methods for DNS amplification traffic, but the broader risk persisted because vulnerable IoT devices remained widely deployed and malware authors could quickly adapt.
Jun 29, 2026