{
  "family": "mirai",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nMirai is arguably the most infamous Internet of Things (IoT) Botnet and Worm in cybersecurity history. Discovered in 2016, Mirai is designed to scan the internet for vulnerable Linux-based IoT devices (such as IP cameras, home routers, and DVRs), compromise them using default credentials, and enlist them into a massive botnet capable of launching unprecedented Distributed Denial-of-Service (DDoS) attacks.\n\n<h3>Propagation and Exploitation Mechanics</h3>\nThe source code for Mirai was leaked online in 2016, leading to the creation of countless variants. However, the core mechanics remain consistent:\n<ul>\n<li><strong>Aggressive Scanning:</strong> Infected devices continuously and aggressively scan the internet for other devices listening on Telnet (Port 23) or SSH (Port 22).</li>\n<li><strong>Brute-Force Infection:</strong> When an open port is found, Mirai attempts to log in using a hardcoded list of over 60 common default usernames and passwords (e.g., `admin:admin`, `root:12345`). If successful, it loads the Mirai payload into the device's volatile memory (RAM).</li>\n<li><strong>Botnet Command and Control:</strong> Once infected, the device connects to a centralized C2 server, awaiting instructions to launch massive volumetric DDoS attacks (such as UDP floods, SYN floods, or HTTP GET floods) against specified targets.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA Mirai infection on a local network can severely degrade internet bandwidth due to its aggressive outbound scanning. Globally, the Mirai botnet has been responsible for some of the largest DDoS attacks on record, taking down major DNS providers, web hosts, and gaming networks, causing millions of dollars in economic damage.\n\n<h3>Remediation and Defense</h3>\n<ul>\n<li><strong>Reboot to Clear (Temporary):</strong> Because Mirai typically resides in volatile RAM, simply rebooting the infected IoT device will clear the infection. However, if the device remains connected to the internet with the same default credentials, it will be re-infected by the botnet within minutes.</li>\n<li><strong>Credential Management:</strong> The only permanent fix is to change the default administrative passwords on all IoT devices immediately upon installation.</li>\n<li><strong>Network Segmentation and Hardening:</strong> Never expose IoT administrative interfaces (Telnet, SSH, web GUIs) directly to the public internet. Place IoT devices on an isolated network segment (VLAN) to prevent them from communicating with or scanning the corporate LAN.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Linux.Mirai",
    "Worm.Mirai",
    "Botnet.Mirai"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1110.001",
    "T1498.001",
    "T1059.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:50:17Z",
  "type": "Botnet / Worm",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}