Mirai

Mirai is a Linux-based IoT botnet malware family best known for compromising internet-exposed embedded devices such as routers, cameras, and similar appliances and conscripting them into distributed denial-of-service botnets. It became a foundational codebase in the IoT threat ecosystem, and numerous later botnets have reused or adapted Mirai-derived components and tradecraft.

Mirai-class activity is characterized by large-scale scanning for exposed services, opportunistic compromise of poorly secured devices, and use of infected hosts to launch DDoS attacks. The family is strongly associated with abuse of weak or default credentials on internet-facing devices, and Mirai-style variants have also incorporated exploitation of known remote code execution and command-injection vulnerabilities in edge and IoT products. Compromised devices are typically Linux-based embedded systems spanning consumer and small-office hardware.

Mirai has had enduring influence well beyond the original botnet. Multiple later frameworks and botnets have been assessed as borrowing code or design lineage from Mirai, including newer IoT botnet families in the broader DDoS ecosystem. Public reporting has also documented Mirai variants being distributed through other malicious infrastructures and proxy ecosystems, underscoring its continued operational relevance years after its emergence.

The malware’s primary operational purpose is botnet formation for DDoS, but Mirai’s broader significance lies in establishing a reusable template for rapidly building IoT attack infrastructure. Its continued reuse reflects the persistence of exposed embedded devices, weak credential hygiene, and slow patching across the IoT landscape.