{ "family": "mirai", "sample_count": 1, "category": "botnet", "description": "Mirai (Japanese for 'the future') is a revolutionary Linux-based malware family and botnet that transformed internet of things (IoT) security upon its emergence in August 2016. Authored by college students Paras Jha, Josiah White, and Dalton Norman to sabotage rival Minecraft gaming servers, Mirai targeted consumer embedded smart devices—including CCTV cameras, IP video recorders (DVRs), home routers, and network-attached storage units—running ARC, ARM, MIPS, and x86 architectures.\n\nMirai continuously scanned IP ranges across the global IPv4 internet on TCP ports 23 and 2323, executing automated dictionary attacks against a hardcoded table of 60+ factory-default Telnet credentials (e.g., 'admin/admin', 'root/xc3511'). Once in control, the malware terminated competing malware processes, bound port 48101 to lock out rival attackers, and joined a centralized command-and-control mesh. In late 2016, Mirai orchestrated record-breaking distributed denial-of-service (DDoS) assaults exceeding 1 Terabit per second against cybersecurity journalist Brian Krebs (KrebsOnSecurity), European hosting giant OVH, and managed DNS provider Dyn—crippling access to major internet platforms including Twitter, GitHub, Spotify, and Netflix across North America and Europe.\n\nIn October 2016, the authors published Mirai's complete C source code on HackForums under the pseudonym 'Anna-senpai' to obscure their operational footprint. In December 2017, Jha, White, and Norman pleaded guilty in US Federal District Court to multiple violations of the Computer Fraud and Abuse Act (CFAA), cooperating with the FBI to mitigate subsequent botnets. The leaked codebase spurred dozens of mutant successor botnets, including Satori, Okiru, Mozi, and Reaper.", "cta": "Published by the SystemHelpdesk team.", "aliases": [ "Mirai", "Linux.Mirai", "Botnet.Mirai", "Worm.Mirai" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is the Mirai botnet?", "acceptedAnswer": { "@type": "Answer", "text": "Mirai is a prolific Linux-based botnet that enslaves smart IoT devices (cameras, routers, DVRs) and launches massive distributed denial-of-service (DDoS) attacks." } }, { "@type": "Question", "name": "Who created Mirai and what happened to them?", "acceptedAnswer": { "@type": "Answer", "text": "Mirai was created by Paras Jha, Josiah White, and Dalton Norman. They pleaded guilty in US federal court in December 2017 to violating the Computer Fraud and Abuse Act." } }, { "@type": "Question", "name": "How did Mirai compromise hundreds of thousands of devices?", "acceptedAnswer": { "@type": "Answer", "text": "Mirai scanned the internet for open Telnet ports (23 and 2323) and attempted automated logins using a hardcoded list of over 60 common default manufacturer username and password combinations." } }, { "@type": "Question", "name": "What was the Dyn DNS attack caused by Mirai?", "acceptedAnswer": { "@type": "Answer", "text": "In October 2016, Mirai targeted managed DNS provider Dyn with an unprecedented multi-vector DDoS attack, rendering major websites like Twitter, Netflix, GitHub, and Reddit unreachable across the United States and Europe." } }, { "@type": "Question", "name": "How can IoT device owners protect against Mirai infections?", "acceptedAnswer": { "@type": "Answer", "text": "Change default administrative passwords, disable remote management and Telnet services, place smart devices behind a secure firewall, and keep router firmware updated." } } ], "faq_count": 5, "mitre_attack": [ "T1110.001", "T1498.001", "T1499.004", "T1046", "T1071.001", "T1562.001" ], "cisa_advisory": null, "last_updated": "2026-07-01T16:50:17Z", "type": "Botnet / Worm", "target_industries": [ "Global / Opportunistic" ], "motivation": "Opportunistic", "threat_actors": [ "Unknown / Cybercriminal" ], "target_geographies": [ "Global" ], "attack_stage": [ "execution", "persistence" ], "ecosystem": [ "windows_pe" ], "is_emerging": false, "first_seen": 2016, "lineage": { "derived_from": [ "qbot / bashlite" ], "variants": [ "mirai v1.0", "mirai source leak (anna-senpai)", "satori", "okiru", "mozi", "reaper (iotroop)" ] }, "attribution": [ { "actor": "Paras Jha, Josiah White, and Dalton Norman (US Federal CFAA Conviction)", "confidence": "high", "basis": "Guilty pleas entered in December 2017 in US District Courts for the District of Alaska and District of New Jersey by Paras Jha, Josiah White, and Dalton Norman for creating and operating the Mirai botnet.", "source": "https://www.justice.gov/opa/pr/justice-department-announces-charges-connection-historic-ddos-attacks-and-efforts-mitigate" } ], "exploited_cves": [ "CVE-2014-8361", "CVE-2017-17215" ], "c2_profile": { "protocols": [ "Custom Binary TCP Protocol", "Telnet Brute-force", "UDP Flooding", "TCP SYN/ACK Flooding", "GRE Flooding", "DNS Amplification" ], "ports": [ 23, 2323, 48101, 7547 ], "infrastructure": "Dynamic DNS domains resolving to VPS servers directing botnet swarm floods and listening for bot check-ins over raw TCP sockets using a lightweight command interpreter." }, "iocs": { "file_hashes": [ "e2c90c74e89bb9c07be24bc5cb808e08d660e515d9da684bc67c33190fc53cb7", "bc1d8469ad0ca93d6e5347e33526ad01c0b1a03e6834ff443a7a9fc27ec8d2a6" ], "delivery": [ "Automated remote Telnet dictionary exploitation over ports 23 and 2323 against default IoT credentials", "Remote command injection into embedded web and TR-069 management interfaces (CVE-2014-8361, CVE-2017-17215)" ], "persistence": [ "RAM-resident process execution with disk binary unlinked via unlink() after memory execution", "Binding TCP port 48101 to prevent reinfection by competing IoT botnets" ] }, "sources": [ { "name": "US DOJ Press Release - Mirai CFAA Guilty Pleas", "url": "https://www.justice.gov/opa/pr/justice-department-announces-charges-connection-historic-ddos-attacks-and-efforts-mitigate" }, { "name": "CISA Advisory - Understanding and Defending Against the Mirai Botnet", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories" }, { "name": "NIST NVD - CVE-2014-8361", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8361" } ], "mitre_attack_detail": [ { "id": "T1110.001", "name": "Brute Force: Password Guessing", "tactic": "Initial Access" }, { "id": "T1498.001", "name": "Network Denial of Service: Direct Network Flood", "tactic": "Impact" }, { "id": "T1499.004", "name": "Endpoint DoS Exploitation", "tactic": "Impact" }, { "id": "T1046", "name": "Network Service Discovery", "tactic": "discovery" }, { "id": "T1071.001", "name": "Application Layer Protocol: Web Protocols (C2 Communication)", "tactic": "Command and Control" }, { "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools", "tactic": "Defense Evasion" } ], "containment_steps": [ "Isolate the host immediately to prevent Mirai from participating in coordinated Distributed Denial of Service (DDoS) attacks or scanning adjacent network segments.", "Block outbound IRC, HTTP, or custom command protocols communicating with Mirai command-and-control servers at enterprise perimeter firewalls.", "Disable AutoRun/AutoPlay and scan removable storage media across the enterprise if Mirai utilizes USB-based propagation vectors.", "Eradicate rootkit drivers or scheduled task persistence mechanisms used to maintain the Mirai bot agent across reboots." ], "what_to_avoid": [ "Do not assume the incident is resolved simply because an antivirus tool removed the initial Mirai dropper; always verify that secondary payloads and persistence hooks have been eradicated.", "Avoid logging in with Domain Admin or privileged credentials on a machine suspected of running Mirai until memory triage is complete.", "Do not delay host isolation; automated lateral movement and credential dumping can occur within minutes of initial execution." ], "target_platforms": [ "Linux", "Embedded Linux / IoT" ] }