Loading story…
JPCERT/CC's TSUBAME sensors detected a sharp increase in Mirai-like traffic targeting Telnet (TCP/23) beginning April 30 and peaking in early May. Source addresses were globally distributed, led by the United States, with substantial increases from Germany, France, Canada, and Japan; Japanese-origin activity rose to roughly 15 times its pre-surge baseline. Many source hosts were associated with hosting providers and exposed cPanel administration interfaces.
The activity may be associated with exploitation of CVE-2026-41940, an authentication-bypass flaw in cPanel/WHM, followed by Mirai or variant infections, although the sensor data does not establish causation. TCP/23 was the most targeted port across domestic and overseas sensors during April–June, alongside broad scanning of TCP/443, TCP/80, TCP/8080, and TCP/22. Organizations should promptly patch exposed cPanel/WHM systems, restrict remote administration access, enforce strong credentials, and investigate anomalous processes and outbound network activity, as Mirai variants can compromise internet-facing servers as well as IoT devices.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Packet volumes rose at both Japanese and overseas TSUBAME sensors, partly due to the Mirai-like TCP/23 surge. Japanese-origin TCP/23 traffic reached roughly 15 times its pre-surge level, and the TCP/23 volume gradually declined after its early-May peak.
Around May 1, sharp increases were observed in Germany, France, and Canada, while the United States represented the largest observed source share. The changing regional distribution indicated infections were broadly distributed rather than concentrated in one region.
JPCERT/CC's TSUBAME sensors recorded a sharp increase in Mirai-like packets targeting TCP port 23. Many source IP addresses were assigned to hosting providers and exposed interfaces appearing to run cPanel.
Censys and the NICTER Analysis Team published information suggesting the infection activity could be associated with exploitation of CVE-2026-41940, an authentication-bypass flaw affecting cPanel/WHM. JPCERT/CC stated that TSUBAME observations alone could not establish the cause of the surge.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceblogs.jpcert.or.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
JPCERT/CC reported that `23/TCP` remained the most frequently targeted destination in TSUBAME internet monitoring data, but the share of traffic with Mirai-like characteristics fell from about 70% at the start of FY2025 to roughly 30% by the end of the fiscal year. The organization said overseas sensors received more packets than domestic sensors, while some sensors recorded heavier activity on `443/TCP`, indicating attackers were not limited to traditional Telnet-focused probing. From June 2025 onward, JPCERT/CC observed increased non-Mirai-like scanning from compromised IoT devices including surveillance cameras, DVRs, NAS devices, broadband routers, Korean-made DVRs, and Chinese-made routers. It also found that Mirai-like sources were communicating over ports beyond `23/TCP`, suggesting attempts to reach internet-exposed services and exploit known product vulnerabilities; JPCERT/CC said it shared the trend data with domestic product developers and telecommunications operators and urged firmware updates, secure configuration, and exposure checks such as port scans or SHODAN searches.
Jul 23, 2026
A renewed **Mirai** botnet campaign is targeting internet-exposed routers and IoT devices by exploiting known vulnerabilities, with advisories highlighting compromises affecting industrial routers, smart home systems, DVRs, cameras, and 5G/LTE equipment. Reported targets include devices from **ASUS, Huawei, Neterbit, LB-Link, Four-Faith, Kguard, Lilin,** and **Vimar**, as well as generic DVR platforms and PZT cameras, indicating broad opportunistic scanning of exposed edge infrastructure. National CERT advisories from Brunei and Colombia warned that Mirai-related botnet activity continues to threaten consumer and industrial environments, including routers and other connected devices. Defenders were urged to **patch exposed systems**, **disable remote access where possible**, **replace default credentials with strong unique passwords**, and **scan networks for vulnerable or internet-facing assets** to reduce the risk of botnet enrollment and downstream abuse such as distributed denial-of-service activity.
Aug 1, 2026