Mirai-Derived Botnets Rebound as Exposed IoT Devices Remain Vulnerable
Summary
Censys finds Mirai-derived botnets recovering after 2026 takedowns, while exposed ADB services and outdated Boa software persist. The analysis links this resilience to insecure IoT supply chains, weak defaults, and limited consumer ability to update devices.
Key points
- Mirai’s leaked code popularized attacks that scan for exposed IoT devices and exploit default credentials or outdated services.
- After a March 2026 takedown, reported Aisuru C2 infrastructure more than doubled against its pre-takedown baseline within four months; the figures come from a community-submitted dataset.
- Kimwolf reportedly fragmented into more than 20 botnets, while daily active DDoS endpoints rose from about 1 million to 8–9 million.
- More than 90% of internet-exposed ADB services observed by Censys used default ports; exposed devices returned to roughly year-earlier levels after an initial post-takedown drop.
- Over 500,000 hosts still ran discontinued Boa software, including more than 19,900 that also presented a Realtek-issued certificate, consistent with Boa being included in chip-level SDKs.
- The article identifies manufacturer SDKs, limited firmware maintenance, default configurations, and end-of-life devices as factors that keep vulnerable IoT products in circulation.
- Censys observed more than 17,000 internet-facing IoT devices with UPnP enabled, which can expose additional network ports if a device is compromised.
Article Details
- Attack Vectors
- Mirai and related botnets scan internet-facing IoT devices, including routers, DVRs, and IP cameras, and attempt to gain access using default or commonly reused credentials.
- Botnets exploit exposed, outdated, or misconfigured services and firmware vulnerabilities; Mirai-derived Aisuru is reported to compromise IoT devices by exploiting new firmware vulnerabilities.
- Kimwolf targets exposed Android Debug Bridge services, particularly those on default ports 5555 or 5037, and spreads through compromised residential proxy networks to reach internal devices.
- The article describes credential spraying and dictionary attacks against randomly scanned IP ranges, using default or commonly reused credentials.
- The article says attackers can use UPnP-opened ports on a compromised, internet-exposed device to pivot into the internal network.
- Mirai and related botnets use compromised devices to conduct DDoS attacks.
- Defensive Notes
- Change default credentials and configurations during device setup, and keep firmware updated.
- Disable UPnP on low-level smart devices exposed to the internet; restrict public access to services intended for local networks, including ADB and router login pages.
- Manufacturers should audit and update underlying SDK components, including inherited and end-of-life software such as Boa; consumers may need to replace devices whose vendors no longer provide firmware updates.
- The article notes that reachability of an exposed ADB service does not establish whether authentication is disabled.
MITRE ATT&CK
T1110.001 · Password GuessingMirai and its heirs are described as using credential spraying and dictionary attacks to guess default or commonly reused device credentials.T1498 · Network Denial of ServiceMirai and related botnets use compromised devices to launch DDoS attacks against online services.
People
Dalton NormanJoined ProTraf Solutions to help build and run the botnet behind its DDoS-for-hire scheme; the article says he later pleaded guilty to CFAA violations.Josiah WhiteCo-founded ProTraf Solutions and helped create the Mirai botnet; the article says he later pleaded guilty to CFAA violations.Paras JhaCo-founded ProTraf Solutions and helped create the Mirai botnet; the article says he later pleaded guilty to CFAA violations.
Threat Actors
Dalton NormanThe article identifies him as a Mirai collaborator who helped build and run the botnet behind ProTraf Solutions’ DDoS scheme.Josiah WhiteThe article identifies him as a Mirai creator involved in ProTraf Solutions’ DDoS scheme.Paras JhaThe article identifies him as a Mirai creator involved in ProTraf Solutions’ DDoS scheme.
Malware
AisuruAisuru’s command-and-control (C2) infrastructure was substantially disrupted.BotenaGoOther malware families, such as BotenaGo, are not built from Mirai’s source code but follow the same underlying methodology and have been linked operationally to Mirai infrastructure, underscoring how durable thisKimwolfKimwolf was assessed as no longer active following the same operation, yet Nokia’s Deepfield team reports it fragmented into more than 20 competing botnets while daily active DDoS endpoints rose from roughly 1 millionMasutaOngoing / Present Day Because the source was leaked, Mirai spawned dozens of variants (Satori, Okiru, Masuta, Reaper, etc.) run by unrelated threat actors.MiraiNearly ten years after its source code was leaked, Mirai’s methodology is still working largely unchanged.OkiruOngoing / Present Day Because the source was leaked, Mirai spawned dozens of variants (Satori, Okiru, Masuta, Reaper, etc.) run by unrelated threat actors.ReaperOngoing / Present Day Because the source was leaked, Mirai spawned dozens of variants (Satori, Okiru, Masuta, Reaper, etc.) run by unrelated threat actors.SatoriOngoing / Present Day Because the source was leaked, Mirai spawned dozens of variants (Satori, Okiru, Masuta, Reaper, etc.) run by unrelated threat actors.
Vendors
Products
Android Debug BridgeInternet-exposed Android Debug Bridge services (Kimwolf’s primary target) dropped immediately after the takedown and have since returned to roughly the level observed a year earlier.BoaOver 500,000 hosts still report running Boa, an HTTP server discontinued in 2005.UPnPMany IoT devices ship with UPnP (Universal Plug and Play) enabled by default, a protocol that lets devices on the same local network automatically discover each other and open router ports without manual configuration.
Countries
Industries
GamingThe mid-2010s were the height of Minecraft’s multiplayer server economy: giant gaming servers where players could play custom minigames together that generated substantial revenue.Internet of ThingsSenators introduced The Internet of Things Cybersecurity Improvement Act of 2017, a bill aimed at setting minimum cybersecurity standards for government-purchased IoT devices.