Mirai (malware)

The software was initially used by the creators to DDoS Minecraft servers and companies offering DDoS protection to Minecraft servers, with the authors using Mirai to operate a protection racket. The source code for Mirai was subsequently published on Hack Forums as open-source. Since the source code was published, the techniques have been adapted in other malware projects.

Malware

Devices infected by Mirai continuously scan the internet for the IP address of Internet of things (IoT) devices. Mirai includes a table of IP address ranges that it will not infect, including private networks and addresses allocated to the United States Postal Service and Department of Defense.

Mirai then identifies vulnerable IoT devices using a table of more than 60 common factory default usernames and passwords, and logs into them to infect them. Infected devices will continue to function normally, except for occasional sluggishness, and an increased use of bandwidth. A device remains infected until it is rebooted, which may involve simply turning the device off and after a short wait turning it back on. After a reboot, unless the login password is changed immediately, the device will be reinfected within minutes. Upon infection Mirai will identify any "competing" malware, remove it from memory, and block remote administration ports.

Victim IoT devices are identified by “first entering a rapid scanning phase where it asynchronously and “statelessly” sent TCP SYN probes to pseudo-random IPv4 addresses, excluding those in a hard-coded IP blacklist, on telnet TCP ports 23 and 2323”. If an IoT device responds to the probe, the attack then enters into a brute-force login phase. During this phase, the attacker tries to establish a telnet connection using predetermined username and password pairs from a list of credentials. Most of these logins are default usernames and passwords from the IoT vendor. If the IoT device allows the Telnet access, the victim's IP, along with the successfully used credential is sent to a collection server.

There are a large number of IoT devices which use default settings, making them vulnerable to infection. Once infected, the device will monitor a command and control server which indicates the target of an attack. The reason for the use of the large number of IoT devices is to bypass some anti-DoS software which monitors the IP address of incoming requests and filters or sets up a block if it identifies an abnormal traffic pattern, for example, if too many requests come from a particular IP address. Other reasons include to be able to marshall more bandwidth than the perpetrator can assemble alone, and to avoid being traced.

Mirai as an Internet of things (IoT) devices threat has not been stopped after the arrest of the actors due to the fact that other actors have utilized the source code on GitHub to evolve Mirai into new variants . Some speculate that the goal is to expand its botnet node to many more IoT devices. The detail of the recent progress of these variants is listed in the following paragraphs.

Variants

On 12 December 2017, researchers identified a variant of Mirai exploiting a zero-day flaw in Huawei HG532 routers to accelerate Mirai botnets infection, implementing two known SOAP related exploits on routers web interface, CVE-2014–8361 and CVE-2017–17215. This Mirai version is called "Satori".

On 14 January 2018, a new variant of Mirai dubbed “Okiru”, the Japanese word for "get up," already targeting popular embedded processor like ARM, MIPS, x86, PowerPC and others was found targeting ARC processors based Linux devices for the first time. Argonaut RISC Core processor (shorted: ARC processors) is the second-most-popular embedded 32 bit processor, shipped in more than 1.5 billion products per year, including desktop computers, servers, radio, cameras, mobile, utility meters, televisions, flash drives, automotive, networking devices (smart hubs, TV modems, routers, wifi) and Internet of Things. Only a relatively small number of ARC-based devices run Linux and are therefore exposed to Mirai.

On 18 January 2018, a successor of Mirai is reported to be designed to hijack cryptocurrency mining operations.

On 26 January 2018, two similar Mirai variant botnets were reported, the more modified version of which weaponizes EDB 38722 D-Link router's exploit to enlist further vulnerable IoT devices. The vulnerability in the router's Home Network Administration Protocol (HNAP) is utilized to craft a malicious query to exploited routers that can bypass authentication, to then cause an arbitrary remote code execution. The less modified version of Mirai is called "Masuta" (after the Japanese transliteration of "Master"), while the more modified version is called "PureMasuta".

In March 2018, a new variant of Mirai, dubbed as "OMG", has emerged to surface with added configurations to target vulnerable IoT devices and turning them into proxy servers. New firewall rules that allow traffic to travel through the generated HTTP and SOCKS ports were added configurations to the Mirai code. Once these ports are open to traffic, OMG sets up 3proxy – open-source software available on a Russian website.

Between May and June 2018, another variant of Mirai, dubbed as "Wicked", has emerged with added configurations to target at least three additional exploits including those affecting Netgear routers and CCTV-DVRs. Wicked scans ports 8080, 8443, 80, and 81 and attempts to locate vulnerable, unpatched IoT devices running on those ports. Researchers suspect the same author created the Wicked, Sora, Owari, and Omni botnets.

In early July 2018 it was reported at least thirteen versions of Mirai malware has been detected actively infecting Linux Internet of things (IoT) in the internet, and three of them were designed to target specific vulnerabilities by using exploit proof of concept, without launching brute-forcing attack to the default credential authentication. In the same month it was published a report of infection campaign of Mirai malware to Android devices through the Android Debug Bridge on TCP/5555, an optional feature in the Android operating system, though it was discovered that this feature appears to be enabled on some Android phones.

At the end of 2018, a Mirai variant dubbed "Miori" started being spread through a remote code execution vulnerability in the ThinkPHP framework, affecting versions 5.0.23 to 5.1.31. This vulnerability is continuously being abused by the further evolved Mirai variants dubbed as "Hakai" and "Yowai" in January 2019, and variant "SpeakUp" in February, 2019.

The Mirai-based “Gayfemboy” botnet, discovered in 2024, targets global systems and exploits multiple vulnerabilities. The effects were also evident in 2025.

The recent Mirai based "Aisuru" botnet, first discovered by XLab in August 2024, believed to have over 300,000 compromised devices, has been causing record breaking DDoS attacks ever since, As of February 2026, has been responsible for the 31.4 Tbps on Cloudflare.