Loading story…
Trend Micro researchers identified a Mirai IoT malware variant that uses SOCKS5 proxies to communicate with a command-and-control server hidden on Tor, complicating infrastructure tracking and takedown. The sample contains 30 hard-coded proxy IP addresses and scans TCP ports 9527 and 34567 to target exposed devices, including IP cameras and DVRs, using possible default credentials. Researchers also identified a command consistent with a UDP-flood DDoS attack and related payloads for multiple device architectures on distribution servers.
The malware’s configuration is XOR-encrypted with 0x22, and the embedded string “LONGNOSE: applet not found” provides a potential identifier for the variant. Organizations should prioritize patching internet-exposed IoT devices and replacing default credentials, alongside signature- and behavior-based detection. Defenders can use the reported scanning ports, embedded string, and proxy-based communications as investigative leads rather than relying solely on visibility into the hidden command-and-control server.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro researchers identified a Mirai variant with 30 hard-coded SOCKS5 proxy addresses used to reach a Tor-hidden command-and-control server. The malware scans TCP ports 9527 and 34567 on exposed IoT devices, including cameras and DVRs; analysis also identified a UDP-flood command and distribution servers hosting payloads for multiple device architectures.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro disclosed a Mirai variant in May 2019 that combined 13 exploits targeting routers, surveillance devices, and the ThinkPHP framework. Detected as **Backdoor.Linux.MIRAI.VWIPT**, the malware supported backdoor access, distributed denial-of-service attacks, and credential brute forcing. Researchers described it as the first observed Mirai campaign to combine all 13 exploits, although those exploits had appeared in earlier attacks. The variant used three XOR keys to encrypt data, with a command-and-control endpoint at `35[.]235[.]102[.]123:1337` and download and dropper URLs hosted under a `hopto[.]org` domain. The discovery complemented Unit 42 reporting on Mirai and Gafgyt IoT/Linux botnet campaigns, highlighting the continued use of vulnerable connected devices as botnet infrastructure. Trend Micro recommended applying security patches and evaluating manufacturers’ security practices and update consistency before connecting devices to networks. Defenders should prioritize exposed routers and surveillance equipment for vulnerability assessment and remediation, while treating the reported infrastructure as historical indicators rather than evidence of current activity.
Oct 9, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
Researchers observed the Mirai-style **KATARU** IoT malware compromising a honeypot through Telnet credential brute forcing before downloading and executing an ARM payload. The malware supports DDoS floods, SSH brute forcing, secondary-payload delivery, arbitrary shell commands, self-removal, anti-analysis checks, and a broad set of Linux, embedded-device, and Android persistence techniques. It also attempts multiple public local privilege-escalation exploits, including some mismatched to the victim architecture. KATARU uses custom encrypted command-and-control communications incorporating RFC 7748 Curve25519/X25519-related test-vector values, apparently as decoy or rapidly reused public code. Researchers assess its noisy, cross-platform persistence and unvalidated exploit logic suggest fast assembly rather than a mature operation. Organizations should disable or tightly restrict Telnet, replace weak device credentials, patch supported firmware and Linux kernels, segment IoT and OT networks, and investigate startup-file or immutable-attribute changes and unusual encrypted outbound or flood-like traffic.
Sep 11, 2026