Loading story…
U.S. authorities unsealed guilty pleas from Paras Jha and Josiah White for creating and operating the Mirai botnet, while Dalton Norman admitted participating in a related click-fraud conspiracy. Prosecutors said Mirai compromised vulnerable Internet of Things devices including routers, cameras, and DVRs, growing to more than 300,000 infected systems that were used for distributed denial-of-service attacks, extortion, and botnet rental activity. Jha and White also pleaded guilty to conspiracy to intentionally damage protected computers under 18 U.S.C. 1030(a)(5)(A).
The case tied Mirai to some of the most disruptive DDoS incidents of the period, including the attack on KrebsOnSecurity and the assault on Dyn that interrupted access to major online services. Court documents said the conspirators also redirected the botnet toward ad-click fraud, generating fraudulent traffic that brought in roughly 200 bitcoin, with Norman personally earning more than 30 bitcoin. Research on Mirai has shown how the malware systematically scanned for poorly secured IoT devices and weaponized them at scale, underscoring how weak default security in connected devices enabled one of the internet’s most consequential botnets.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
On October 21, 2016, a Mirai botnet was used in the attack on Dyn. The disruption affected major online services including Twitter, Netflix, and Reddit.
On September 20, 2016, a Mirai botnet attack sourced from more than 175,000 IoT devices struck KrebsOnSecurity. The attack peaked at 620 Gbps and led Akamai to remove the site from its network because of the impact on paying customers.
At the end of September 2016, the Mirai source code was released publicly by its authors. The release led to multiple copycat Mirai botnets competing for vulnerable IoT devices.
An update in the article states that Paras Jha also pleaded guilty in a separate New Jersey case involving DDoS attacks against Rutgers University. No explicit date for that plea is provided in the content.
On Tuesday, the U.S. Department of Justice unsealed guilty pleas from Paras Jha and Josiah White for developing and using Mirai, and from Dalton Norman for participating in a related click-fraud conspiracy. The plea documents said the conspirators also leased botnet access for click fraud and rented it to other cybercriminals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Mirai** malware turned insecure internet-connected devices into massive DDoS botnets that powered some of the largest attacks publicly reported, including floods against **OVH**, **KrebsOnSecurity**, and DNS provider **Dyn**. The botnet spread by logging into exposed IoT devices such as cameras, DVRs, routers, and gateways with hardcoded or default credentials, and defenders later warned that products including certain **Sierra Wireless AirLink** gateways could be conscripted if factory passwords were left unchanged. After the malware’s source code was released publicly under the alias **"Anna-senpai"**, multiple actors were able to build copycat botnets, increasing attack volume and complicating attribution. The Dyn attack disrupted access to major online services including **Twitter, Spotify, Reddit, GitHub, Airbnb, Shopify, SoundCloud, and The New York Times**, with Dyn describing a highly distributed, adaptive campaign delivered in several waves from vast numbers of IP addresses. Investigative reporting tied Mirai’s origins to the DDoS-for-hire and Minecraft-hosting ecosystem and presented evidence linking the **Anna-senpai** persona to **Paras Jha** and associates, while later reporting showed Mirai variants continued launching attacks long after the original incidents. Researchers identified limited countermeasures, including crashing some bots via a flaw in Mirai’s HTTP flood code and traceback methods for DNS amplification traffic, but the broader risk persisted because vulnerable IoT devices remained widely deployed and malware authors could quickly adapt.
Jun 29, 2026
Researchers and later federal prosecutors tied the Mirai-derived **Satori/Masuta** botnet activity to the alias **Nexus Zeta**, identified in court reporting as Kenneth Currin Schuchman. Security reporting said Satori rapidly infected hundreds of thousands of IoT devices by exploiting router flaws rather than relying only on default credentials, including `CVE-2017-17215` in Huawei gateways, `CVE-2014-8361` in Realtek UPNP SOAP interfaces, and a D-Link HNAP injection issue used by the **PureMasuta** branch. NewSky linked **Masuta** and **PureMasuta** to the same operator through shared command-and-control infrastructure and leaked source code, while investigators said operational security mistakes connected the botnet’s online persona to a real-world suspect. The malware family continued to evolve after initial disruption efforts. A successor dubbed **Satori.Coin.Robber** targeted exposed Claymore Miner management interfaces on port `3333` to redirect Ethereum mining rewards by changing pool and wallet settings, while still scanning for vulnerable devices on ports `37215` and `52869`. Later technical analysis showed Satori broadened support for additional processor architectures, including **superh** and **ARC**, making it one of the first known ARC-targeting malware families and underscoring how Mirai-style botnets were shifting toward exploit-driven propagation, persistent command-and-control, and large-scale DDoS capability across insecure embedded devices.
Aug 15, 2026
U.S., Canadian, and German authorities disrupted the command-and-control infrastructure of four major IoT botnets — **Aisuru, KimWolf, JackSkid, and Mossad** — that collectively compromised more than **three million** internet-connected devices worldwide. Investigators said the botnets, built largely from vulnerable **DVRs, IP cameras, web cameras, and enterprise Wi‑Fi routers**, were used in hundreds of thousands of distributed denial-of-service attacks, including operations targeting **U.S. Department of Defense** systems, other high-value networks, and critical infrastructure. Officials said the malware networks were capable of generating traffic above **30 Tbps**, with one attack reaching roughly **31.4 Tbps**, placing them among the largest DDoS threats recorded. The operators allegedly ran the infrastructure as a **DDoS-for-hire** service and also used it for extortion, threatening victims with sustained attacks unless they paid. The U.S. action, led by the Defense Criminal Investigative Service with support from the FBI Anchorage Field Office, included seizure warrants for domains and virtual servers, while Germany’s **BKA** and Canada’s **RCMP** carried out parallel enforcement steps. Private-sector partners including **Akamai, AWS, Cloudflare, Team Cymru, and The Shadowserver Foundation** supported the disruption. Authorities said the takedown degraded the botnets’ ability to operate, but warned that the underlying risk remains because millions of infected or insecure devices are still online with weak credentials or outdated firmware.
Jun 29, 2026