Loading story…
Researchers reported new Mirai samples compiled for processor architectures not previously seen in the malware family, including Altera Nios II, OpenRISC, Tensilica Xtensa, and Xilinx MicroBlaze, broadening the range of embedded devices that can be recruited into botnets. The samples introduced a modified XOR-based obfuscation routine and a new DDoS capability, attack_method_ovh, that mirrors Mirai’s existing TCP SYN attack behavior. Investigators linked the malware to infrastructure at 178.62.227[.]13, which had also hosted earlier Mirai payloads exploiting ThinkPHP RCE, Netgear RCE, CVE-2014-8361, and CVE-2017-17215.
A related Mirai campaign also targeted enterprise wireless presentation and display systems and used multi-architecture Linux payloads distributed from autourbe[.]com.co, with command-and-control traffic tied to epicrustserver[.]cf:3933. Researchers connected 185.248[.]140.102 to prior hosting of both Mirai binaries named clean.* and Gafgyt samples named eeppinen.*, indicating overlapping botnet infrastructure and continued efforts to expand infection across diverse embedded and enterprise-connected devices for larger DDoS operations.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
On February 22, 2019, the server at 178.62.227[.]13 was updated to stop exposing file listings while continuing to host the Mirai samples.
In late February 2019, Unit 42 discovered new Mirai samples compiled for Altera Nios II, OpenRISC, Tensilica Xtensa, and Xilinx MicroBlaze, architectures it said had not previously been seen in Mirai. The samples also used a modified XOR-based obfuscation routine and included the attack_method_ovh DDoS option.
Unit 42 reported that Mirai samples using the DDoS option attack_method_ovh had been circulating in the wild since November 2018 on previously known processor architectures.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 175 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
Researchers tracked the Mirai-derived **Echobot** botnet as it rapidly expanded from 18 exploits to 59 and then **71** exploits, broadening propagation across routers, cameras, NAS devices, smart home hubs, servers, SD-WAN appliances, Oracle WebLogic, Barracuda Web Application Firewall, Citrix NetScaler, video conferencing systems, and administration tools. The malware relied heavily on publicly available remote code execution and command-execution exploits, including both legacy flaws dating back to 2003 and newer issues such as **`CVE-2019-15107`** in Webmin, showing how quickly commodity botnet code can be upgraded into large-scale exploit-driven malware. The most notable escalation was Echobot’s move into industrial environments through exploitation of **`CVE-2019-14927`** affecting Mitsubishi Electric remote terminal units, an uncommon step for a Mirai-family botnet toward **SCADA** and critical infrastructure-related devices. Researchers said the malware spread through a bash dropper named **Richard**, which downloaded, compiled, and executed payloads for at least 13 processor architectures, while infrastructure linked to the campaign included open or compromised servers and changing command-and-control domains and ports. The activity underscored Mirai’s continued evolution away from simple default-credential abuse and toward aggressive exploit-based propagation to build larger botnets, likely for **DDoS** operations.
Aug 15, 2026
New variants of the **Mirai** and **Gafgyt** IoT/Linux botnets were observed expanding from consumer devices to enterprise-facing systems by exploiting known vulnerabilities in **Apache Struts** and **SonicWall Global Management System**. Palo Alto Networks Unit 42 reported that a Mirai sample targeted `CVE-2017-5638`, the remote code execution flaw in Apache Struts tied to the Equifax breach, marking the first known case of Mirai using that exploit in the wild. A Gafgyt variant was also seen exploiting `CVE-2018-9866` in older, unsupported SonicWall GMS versions shortly after a Metasploit module for the bug became public. Researchers linked both malware families through infrastructure involving **l[.]ocalhost[.]host** and said the Mirai sample carried 16 exploits in total, while the Gafgyt sample included scanning and DDoS capabilities such as **Blacknurse**, underscoring a broader shift by IoT/Linux botnets toward outdated enterprise targets.
Aug 14, 2026