Loading story…
Researchers reported multiple fast-moving IoT/Linux botnet campaigns built from Mirai and Gafgyt code that aggressively targeted embedded devices through known vulnerabilities and, in some cases, credential brute forcing. Palo Alto Networks said the campaigns—linked to evolutions of Omni, Okane, and Hakai—combined as many as 11 exploits in a single sample and introduced new distributed denial-of-service techniques, while related Gafgyt malware added an HTTPCF Layer 7 attack command aimed at Cloudflare-protected URLs. One newly adopted vector was the unauthenticated remote command execution flaw in D-Link DSL-2750B routers, which attackers incorporated shortly after public exploit tooling became available.
The activity mirrors earlier reporting on IoT_reaper, a rapidly spreading botnet that also favored exploit-driven propagation over Mirai-style weak-password attacks. Netlab 360 said Reaper integrated at least nine exploits across products from D-Link, Netgear, Linksys, AVTECH, GoAhead, JAWS, and Vacron, maintained multiple command-and-control components, and at one point showed more than 10,000 daily active bot IPs on a tracked server, with millions of vulnerable devices queued for infection. Together, the reports show botnet operators quickly weaponizing public disclosures and modules to compromise internet-exposed routers and cameras at scale, then repurposing those infections for DDoS and broader botnet operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
On June 19, Okane samples hosted on the server were stripped of their exploit code and returned to brute-force propagation followed by dropping a shell script.
On June 13, some Okane samples temporarily replaced their normal payload source with the Cloudflare DNS server address 1.1.1.1.
A Metasploit module for the D-Link DSL-2750B OS command injection vulnerability became available, enabling easier weaponization of the flaw.
Newer Hakai samples incorporated exploitation of the D-Link DSL-2750B OS command injection flaw shortly after the Metasploit module was published, and also changed payload sourcing to 178.128.185.250.
By the end of May 2018, three IoT/Linux malware campaigns based on Mirai and Gafgyt source code had emerged, with some samples combining up to eleven known exploits against embedded devices.
As of October 19, one tracked IoT_reaper command-and-control server was seeing more than 10,000 unique active bot IP addresses per day.
Researchers reported another IoT_reaper update on October 16, further indicating active development of the malware during its expansion phase.
The report says the attacker added additional exploits in an update on October 12 as the botnet continued expanding its propagation capabilities.
The IoT_reaper operators incorporated a Vacron NVR remote exploit that had been disclosed on October 8, showing they were rapidly updating the botnet's exploit arsenal.
Researchers observed a new malicious IoT-targeting sample and identified the emerging botnet family later named IoT_reaper. The malware relied on exploiting device vulnerabilities rather than weak-password brute forcing.
A Full Disclosure post described a remote command execution vulnerability affecting D-Link DSL-2750B firmware versions 1.01 to 1.03 that required no authentication.
Related Gafgyt samples associated with the Omni infrastructure at 213.183.53.120 introduced an HTTPCF command that invoked a SendHTTPCloudflare function to target URL paths commonly used by Cloudflare-protected sites. This represented a new DDoS capability beyond the exploit-propagation behavior already documented for the campaigns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
researchcenter.paloaltonetworks.com
Open sourceblog.paloaltonetworks.com
Open sourceblog.netlab.360.com
Open sourceblog.netlab.360.com
Open sourceseclists.org
Open sourceblogs.securiteam.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that the **Reaper** IoT botnet, also tracked as **IoTroop**, was spreading by exploiting known vulnerabilities in Internet-connected routers and cameras instead of relying mainly on default passwords as **Mirai** did. Check Point said the malware had already compromised roughly **one million organizations**, while Netlab 360 described its scanning as more selective and stealthy than Mirai’s, raising concern that Reaper could assemble a significantly larger botnet for future **DDoS** attacks or other malicious operations. The malware was linked to exploits for at least nine published flaws affecting devices from vendors including **Linksys**, **Netgear**, **D-Link**, **AVTECH**, and products using vulnerable custom **GoAhead**-based camera software. Referenced weaknesses included older Linksys router vulnerabilities and severe camera flaws such as the **WIFICAM** issues assigned **`CVE-2017-8221`** through **`CVE-2017-8225`**, which enabled pre-authentication compromise and root-level code execution. Researchers warned that large numbers of exposed, unpatched IoT devices remained reachable from the Internet, creating conditions for another Mirai-scale disruption unless organizations rapidly patch, isolate, or replace affected systems.
Aug 15, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
Palo Alto Networks Unit 42 reported that a new **Mirai** campaign is targeting internet-exposed IoT devices by chaining multiple known exploits to compromise systems and pull them into a botnet. The activity focuses on broad opportunistic scanning and exploitation, continuing Mirai’s long-running pattern of abusing weakly secured embedded devices such as routers, cameras, and other Linux-based appliances. The campaign’s significance lies in its use of several IoT vulnerabilities rather than a single flaw, increasing the number of devices that can be infected and used for follow-on malicious activity such as distributed denial-of-service (**DDoS**) attacks. The report highlights the ongoing risk from unpatched and publicly reachable IoT infrastructure, underscoring the need for rapid patching, exposure reduction, and stronger hardening of embedded systems connected to the internet.
Jun 29, 2026