Loading story…
CUJO AI researchers collected 438 malicious scripts and 2,792 Linux ELF binaries during August–November 2021 monitoring of IoT botnets, with Mirai and Gafgyt variants predominating. Only 8% of the binaries contained vulnerability-exploitation functionality. Researchers identified 20 targeted vulnerabilities, characterized as command-injection flaws enabling remote code execution; most were several years old. The most frequently observed flaw, CVE-2017-17215 in Huawei routers, was commonly paired with CVE-2014-8361 in the Realtek SDK.
Alongside continued exploitation of older flaws, the Dark IoT Mirai variant incorporated CVE-2021-35395 within four days of its publication, demonstrating how quickly botnet operators could adopt newly disclosed vulnerabilities. The findings reinforce the need for strong device credentials, regular firmware updates, and rapid patching of internet-exposed IoT devices. The 8% figure does not represent the full role of exploits in infections: the analysis excluded exploitation performed before malware binaries were downloaded.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Mirai's source code became publicly available in 2016, the same year the malware was first discovered.
Mirai was first discovered in 2016. Like Gafgyt, it primarily builds botnets for distributed denial-of-service attacks.
Gafgyt's source code leaked in 2015, making the botnet malware's code publicly available.
Gafgyt was first observed in 2014. The malware primarily recruits compromised devices into botnets used for distributed denial-of-service attacks.
CUJO AI's analysis found vulnerability-exploitation functionality in only 8% of collected binaries, collectively targeting 20 vulnerabilities characterized as command-injection flaws enabling remote code execution. Huawei router flaw CVE-2017-17215 was the most frequently targeted, commonly paired with Realtek SDK flaw CVE-2014-8361; the analysis excluded exploitation performed before malware binaries were downloaded.
Researchers observed exploitation of CVE-2020-8958 only at the end of November, targeting diagnostic command-injection interfaces in Guangzhou and OptiLink GPON devices. Every analyzed sample targeting this flaw also contained exploits for seven other vulnerabilities or vulnerable interfaces.
Researchers observed Dark IoT samples exploiting CVE-2021-35395 on August 20, four days after the vulnerability was published. Dark IoT is a Mirai variant that rapidly incorporates newly published exploits.
CVE-2021-35395, affecting the Realtek AP-Router SDK, was published on August 16. The source does not explicitly state the year of that publication date.
Gyorgy Luptak and Dorka Palotay investigated botnet activity in customer networks during an August–November monitoring period. They collected 438 malicious script files and 2,792 ELF binaries, predominantly Mirai and Gafgyt variants.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that a new **Mirai** campaign is targeting internet-exposed IoT devices by chaining multiple known exploits to compromise systems and pull them into a botnet. The activity focuses on broad opportunistic scanning and exploitation, continuing Mirai’s long-running pattern of abusing weakly secured embedded devices such as routers, cameras, and other Linux-based appliances. The campaign’s significance lies in its use of several IoT vulnerabilities rather than a single flaw, increasing the number of devices that can be infected and used for follow-on malicious activity such as distributed denial-of-service (**DDoS**) attacks. The report highlights the ongoing risk from unpatched and publicly reachable IoT infrastructure, underscoring the need for rapid patching, exposure reduction, and stronger hardening of embedded systems connected to the internet.
Jun 29, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
New variants of the **Mirai** and **Gafgyt** IoT/Linux botnets were observed expanding from consumer devices to enterprise-facing systems by exploiting known vulnerabilities in **Apache Struts** and **SonicWall Global Management System**. Palo Alto Networks Unit 42 reported that a Mirai sample targeted `CVE-2017-5638`, the remote code execution flaw in Apache Struts tied to the Equifax breach, marking the first known case of Mirai using that exploit in the wild. A Gafgyt variant was also seen exploiting `CVE-2018-9866` in older, unsupported SonicWall GMS versions shortly after a Metasploit module for the bug became public. Researchers linked both malware families through infrastructure involving **l[.]ocalhost[.]host** and said the Mirai sample carried 16 exploits in total, while the Gafgyt sample included scanning and DDoS capabilities such as **Blacknurse**, underscoring a broader shift by IoT/Linux botnets toward outdated enterprise targets.
Aug 14, 2026