Loading story…
Palo Alto Networks Unit 42 reported two previously unidentified command-injection vulnerabilities in internet-exposed IoT services that were actively exploited to deliver Mirai malware. One campaign abused an unsanitized NTP_SERVER HTTP parameter in a web service used to configure NTP settings, while the other targeted an unsanitized pid HTTP parameter in what researchers believe was a remote process management service. In successful intrusions, the attackers invoked wget to fetch a shell script that then downloaded and executed Mirai binaries built for multiple processor architectures.
Researchers observed the first campaign between July and September 2020 and a second burst of exploitation that generated 48 incidents in 12 seconds. Across both campaigns, four Mirai variants were deployed, all capable of DDoS activity, while one variant also carried worm-like propagation features that leveraged numerous known IoT and remote-code-execution exploits. The findings underscore the continued exposure created by unsupported IoT devices, and the report included indicators of compromise such as malware hashes, hosting IP addresses, and Mirai command-and-control domains.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported that the first observed NTP_SERVER-based exploit campaign continued until Sept. 23, 2020. By the time of reporting, that campaign had generated 42 unique alerts.
On Aug. 16, 2020, Unit 42 observed a second command-injection campaign abusing the pid HTTP parameter, which researchers suspected targeted a remote process management service. The activity generated 48 attack incidents within 12 seconds and delivered additional Mirai variants.
Unit 42 first observed a command-injection campaign abusing the NTP_SERVER HTTP parameter to deliver Mirai malware to IoT devices. Successful exploitation triggered wget to fetch a shell script that downloaded and executed Mirai binaries for multiple architectures.
Palo Alto Networks Unit 42 disclosed its analysis of two in-the-wild exploit campaigns that delivered four Mirai variants, including one variant with worm-like propagation using numerous known IoT and RCE exploits. The report also published indicators of compromise such as malware hashes, hosting IPs, and Mirai C2 domains.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that a new **Mirai** campaign is targeting internet-exposed IoT devices by chaining multiple known exploits to compromise systems and pull them into a botnet. The activity focuses on broad opportunistic scanning and exploitation, continuing Mirai’s long-running pattern of abusing weakly secured embedded devices such as routers, cameras, and other Linux-based appliances. The campaign’s significance lies in its use of several IoT vulnerabilities rather than a single flaw, increasing the number of devices that can be infected and used for follow-on malicious activity such as distributed denial-of-service (**DDoS**) attacks. The report highlights the ongoing risk from unpatched and publicly reachable IoT infrastructure, underscoring the need for rapid patching, exposure reduction, and stronger hardening of embedded systems connected to the internet.
Jun 29, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
Attackers were observed exploiting **`CVE-2020-9020`**, a critical remote command execution flaw in **Iteris Vantage Velocity** field units, to deploy a **Satori** variant of the **Mirai** botnet. The activity targeted versions **2.3.1, 2.4.2, and 3.0** through crafted HTTP requests to the vulnerable **`/cgi-bin/timeconfig.py`** endpoint, injecting commands via the **`htmlNtpServer`** parameter and downloading malware from **`198.23.238.203`**. The malware was built to compromise multiple CPU architectures and then scan random hosts over **Telnet port 23** using an embedded password dictionary, behavior consistent with Mirai-style propagation. Researchers said infected traffic-monitoring devices could be repurposed for **botnet enrollment, DDoS operations, or data leakage**, and noted communications with a suspected command-and-control service over **SSL on port 5684**; affected organizations were urged to patch or upgrade exposed systems.
Aug 14, 2026