Loading story…
Researchers observed the Mirai-style KATARU IoT malware compromising a honeypot through Telnet credential brute forcing before downloading and executing an ARM payload. The malware supports DDoS floods, SSH brute forcing, secondary-payload delivery, arbitrary shell commands, self-removal, anti-analysis checks, and a broad set of Linux, embedded-device, and Android persistence techniques. It also attempts multiple public local privilege-escalation exploits, including some mismatched to the victim architecture.
KATARU uses custom encrypted command-and-control communications incorporating RFC 7748 Curve25519/X25519-related test-vector values, apparently as decoy or rapidly reused public code. Researchers assess its noisy, cross-platform persistence and unvalidated exploit logic suggest fast assembly rather than a mature operation. Organizations should disable or tightly restrict Telnet, replace weak device credentials, patch supported firmware and Linux kernels, segment IoT and OT networks, and investigate startup-file or immutable-attribute changes and unusual encrypted outbound or flood-like traffic.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The IRTF published RFC 7748, “Elliptic Curves for Security,” specifying Curve25519/Curve448 and the X25519 and X448 scalar-multiplication functions, including test vectors.
Nozomi Networks identified and named the KATARU family after a ChaCha20 nonce found in its configuration. The reporting associated KATARU samples and loaders with several SHA-256 hashes and identified 160[.]191.242.92 as both a Telnet credential-brute-force source and KATARU C2 infrastructure.
KATARU was found to use an encrypted custom C2 protocol based on ephemeral X25519 and ChaCha20-Poly1305, with a pinned public key matching an RFC 7748 X25519 test vector. It supports C2-directed network floods, SSH credential brute forcing, payload downloads, shell-command execution, and self-removal.
Analysis of the KATARU ARM sample identified public Linux local-privilege-escalation code for CVE-2026-46300, CVE-2026-43284, and CVE-2026-31431, alongside extensive Linux, embedded-device, and Android persistence attempts. The sample's embedded x86 shellcode indicated the exploit code was likely copied without architecture-specific adaptation.
KATARU IoT malware was observed accessing a honeypot from a Vietnam-based IP address via Telnet credential brute forcing, then using BusyBox commands to retrieve and execute an ARM payload named vlxx.arm.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourcenozominetworks.com
Open sourcerfc-editor.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet and other reporting identified **Nexcorium**, a Mirai-derived malware strain targeting Internet of Things devices, particularly **TBK DVR-4104** and **DVR-4216** video recorder systems used with security cameras. The campaign exploits **`CVE-2024-3721`**, an OS command injection flaw, to run a downloader script that retrieves malware binaries for multiple Linux architectures. Fortinet linked the activity to a suspected actor it calls **Nexus Team**, citing the custom HTTP header `X-Hacked-By: Nexus Team – Exploited By Erratic.` Once installed, Nexcorium uses classic Mirai-style scanner, watchdog, and attack modules, establishes persistence through mechanisms including init, `rc.local`, systemd, and cron, and spreads further through brute-force Telnet activity, default-password abuse, and exploitation of **`CVE-2017-17215`** in Huawei HG532 devices. The malware performs self-checks, replication, and self-deletion to improve resilience and evasion, then connects to the command-and-control domain `r3brqw3d[.]b0ats[.]top` to receive instructions for **DDoS** operations, including UDP, TCP SYN, TCP ACK, SMTP, and VSE query floods.
Jun 29, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
Attackers were observed exploiting **`CVE-2020-9020`**, a critical remote command execution flaw in **Iteris Vantage Velocity** field units, to deploy a **Satori** variant of the **Mirai** botnet. The activity targeted versions **2.3.1, 2.4.2, and 3.0** through crafted HTTP requests to the vulnerable **`/cgi-bin/timeconfig.py`** endpoint, injecting commands via the **`htmlNtpServer`** parameter and downloading malware from **`198.23.238.203`**. The malware was built to compromise multiple CPU architectures and then scan random hosts over **Telnet port 23** using an embedded password dictionary, behavior consistent with Mirai-style propagation. Researchers said infected traffic-monitoring devices could be repurposed for **botnet enrollment, DDoS operations, or data leakage**, and noted communications with a suspected command-and-control service over **SSL on port 5684**; affected organizations were urged to patch or upgrade exposed systems.
Aug 14, 2026