Loading story…
Researchers tracked the Mirai-derived Echobot botnet as it rapidly expanded from 18 exploits to 59 and then 71 exploits, broadening propagation across routers, cameras, NAS devices, smart home hubs, servers, SD-WAN appliances, Oracle WebLogic, Barracuda Web Application Firewall, Citrix NetScaler, video conferencing systems, and administration tools. The malware relied heavily on publicly available remote code execution and command-execution exploits, including both legacy flaws dating back to 2003 and newer issues such as CVE-2019-15107 in Webmin, showing how quickly commodity botnet code can be upgraded into large-scale exploit-driven malware.
The most notable escalation was Echobot’s move into industrial environments through exploitation of CVE-2019-14927 affecting Mitsubishi Electric remote terminal units, an uncommon step for a Mirai-family botnet toward SCADA and critical infrastructure-related devices. Researchers said the malware spread through a bash dropper named Richard, which downloaded, compiled, and executed payloads for at least 13 processor architectures, while infrastructure linked to the campaign included open or compromised servers and changing command-and-control domains and ports. The activity underscored Mirai’s continued evolution away from simple default-credential abuse and toward aggressive exploit-based propagation to build larger botnets, likely for DDoS operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
F5 Networks researchers detected a new Echobot variant that expanded its exploit arsenal to 71 and added targets including Mitsubishi Electric RTUs, Barracuda WAF, Citrix NetScaler, video conferencing systems, and administration tools. The report highlighted the unusual inclusion of an industrial control system exploit, CVE-2019-14927, in a Mirai-family botnet.
The F5 report states that the U.S. Department of Homeland Security issued an alert in September 2019 covering CVE-2019-14927 in Mitsubishi Electric remote terminal units. The vulnerability later appeared in Echobot's exploit arsenal.
Carlos Brendel Alcañiz identified a new Echobot variant using 59 exploits to propagate across routers, cameras, NAS devices, servers, database software, and other network-connected products. The report said the operator relied on publicly available exploits and hosted the dropper in a file named Richard on an open server.
On June 7, 2019, Palo Alto Networks Unit 42 published analysis of a new Mirai variant containing 18 exploits, including eight not previously seen in Mirai campaigns. The malware targeted a broad range of embedded and IoT devices and reflected Mirai's shift toward exploit-driven propagation.
Palo Alto Networks observed malware samples for the Mirai variant later dubbed Echobot being hosted in an open directory and updated multiple times between May 19 and May 26, 2019. The final observed version was uploaded on May 26 and used updated command-and-control endpoints.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
f5.com
Open sourcebleepingcomputer.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
FortiGuard Labs disclosed a previously undocumented Linux botnet, **Evooo1Bot**, a Mirai-derived malware family that has been actively targeting Internet-facing devices since at least July 2026. The botnet exploits known vulnerabilities in routers, firewalls, IP cameras, and other edge hardware from vendors including **Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda, and Telesquare**, then deploys architecture-specific binaries from a shared loader at `91.92.40[.]118`. Researchers said the malware clears bash history after infection, performs anti-analysis and anti-sandbox checks, and communicates with its command-and-control infrastructure over encrypted channels on port `443`. Evooo1Bot expands on typical Mirai behavior with **SSH brute-force scanning**, credential sniffing for default or exposed access credentials, persistence mechanisms, and an integrated exploit module for multiple known flaws. Researchers highlighted its reverse **SOCKS proxy** capability as the most consequential feature because compromised edge devices can be repurposed as long-lived relay nodes to conceal attacker origin, support lateral movement, and enable follow-on intrusions into internal networks. Reported activity has been concentrated across North America, South America, Europe, India, China, and Japan, underscoring broad exposure for organizations running unpatched perimeter devices.
Aug 18, 2026
Palo Alto Networks Unit 42 reported that a new **Mirai** campaign is targeting internet-exposed IoT devices by chaining multiple known exploits to compromise systems and pull them into a botnet. The activity focuses on broad opportunistic scanning and exploitation, continuing Mirai’s long-running pattern of abusing weakly secured embedded devices such as routers, cameras, and other Linux-based appliances. The campaign’s significance lies in its use of several IoT vulnerabilities rather than a single flaw, increasing the number of devices that can be infected and used for follow-on malicious activity such as distributed denial-of-service (**DDoS**) attacks. The report highlights the ongoing risk from unpatched and publicly reachable IoT infrastructure, underscoring the need for rapid patching, exposure reduction, and stronger hardening of embedded systems connected to the internet.
Jun 29, 2026