Mirai Botnet: How It Works, Attacks, and Protection

The Mirai botnet is malware that infects Internet of Things (IoT) devices, such as routers, IP cameras, and digital video recorders, and conscripts them into a network of remotely controlled bots used to launch distributed denial-of-service (DDoS) attacks. It spreads by scanning the internet for devices protected only by factory-default usernames and passwords, logging in, and installing itself. First identified in 2016, Mirai powered several of the largest DDoS attacks recorded to that point and remains one of the most active malware families on the internet today.

After its source code was published in late 2016, Mirai splintered into hundreds of variants. Researchers now track more than 116 distinct branches, and a Mirai-based botnet was behind a record 5.6 Tbps DDoS attack in early 2025. This guide explains what Mirai is, how it infects devices and launches attacks, the incidents that made it notorious, who built it, the variants that followed, whether it remains active, and how to protect devices from it.

What is the Mirai Botnet?

Mirai is a strain of malware that targets Linux-based IoT devices and turns them into bots, sometimes called zombies. The collection of infected devices forms a botnet, a network the operator controls remotely from a command-and-control (C2) server. Because a single operator can direct hundreds of thousands of devices at once, a Mirai botnet generates enough traffic to overwhelm and knock offline large websites, services, and infrastructure.

The name Mirai is Japanese for "future," and the malware was built to do one thing efficiently: assemble cheap, insecure consumer devices into a weapon. Its original purpose was DDoS, but modern variants have broadened into cryptomining, residential proxy services, and data theft. What separates Mirai from earlier botnets is its focus on IoT hardware, a vast and poorly secured population of devices that owners rarely patch or monitor.

How Does the Mirai Botnet Work?

Mirai operates as a self-propagating worm. Each infected device hunts for new victims while waiting for attack orders, which lets the botnet grow on its own. The process runs through five stages.

1. Scanning

An infected device sends out probes to random IP addresses across the internet, looking for open Telnet ports (TCP 23 and 2323). Telnet is an old remote-access protocol that many IoT devices leave enabled and exposed by default.

2. Brute-Forcing Default Credentials

When the scanner finds an open Telnet port, it attempts to log in using a built-in list of roughly 60 factory-default username and password pairs, such as admin/admin or root/12345. Devices whose owners never changed the default credentials fall almost immediately, which is the single weakness that makes Mirai so effective.

3. Reporting and Loading

Successful logins are sent to a report server, which passes the device details to a loader. The loader identifies the device's processor architecture, then downloads and runs the matching Mirai payload. Multi-architecture support lets one botnet infect many different device types, from routers to cameras.

4. Command and Control (C2)

Once running, the bot connects back to its C2 server and waits for instructions. Mirai lives in memory rather than on disk, kills competing malware on the device, and blocks remote-management ports to keep rivals out. A reboot removes the infection, but a freshly cleaned device is often reinfected within minutes because scanning never stops.

5. Launching DDoS Attacks

On command, every bot floods a chosen target at once. Mirai supports multiple DDoS attack methods, including UDP, SYN, ACK, GRE, and DNS floods at the network layer, and HTTP floods at the application layer. The combined traffic from a large botnet saturates the target's bandwidth or exhausts its servers, causing an outage. Newer variants add non-DDoS jobs such as cryptomining and proxying on top of these attacks.

What Devices Does Mirai Target?

Mirai targets internet-connected devices that run lightweight Linux and ship with weak security. The most commonly infected categories are consumer and small-business hardware that stay online continuously and receive few updates:

• Home and office routers from vendors such as D-Link, TP-Link, Netgear, Linksys, and ASUS.
• IP cameras and CCTV systems, which frequently expose remote-access interfaces to the internet.
• Digital and network video recorders (DVRs and NVRs) used with surveillance setups.
• Other IoT hardware, including printers, smart appliances, and industrial sensors.

Early Mirai relied almost entirely on default credentials. Modern variants go further, exploiting known software vulnerabilities (CVEs) in specific devices, including flaws in GeoVision, D-Link, TP-Link, Huawei, and AVTECH products. This shift means that even devices with changed passwords can be conscripted if their firmware is unpatched.

Famous Mirai Botnet Attacks

Mirai announced itself in the autumn of 2016 with a series of record-breaking attacks. The timeline below traces the events that made it notorious.

The KrebsOnSecurity Attack

On September 20, 2016, the security journalist Brian Krebs saw his website hit with around 620 Gbps of traffic from more than 175,000 hijacked devices, nearly double the largest attack his DDoS mitigation provider had handled before. The provider withdrew its pro bono protection under the load, and Krebs's site went dark until Google's Project Shield took over its defense.

The OVH Attack

Days later, the French hosting provider OVH absorbed a DDoS that approached 1 Tbps, one of the largest on record at the time. The intended target was a Minecraft server, an early clue that much of Mirai's activity revolved around extorting and disrupting online gaming services.

The Dyn Attack

On October 21, 2016, a Mirai variant struck Dyn, a major DNS provider, in three waves using roughly 100,000 devices. Because DNS is the internet's address book, taking Dyn offline made dozens of major sites, including Twitter, Reddit, Netflix, Spotify, Amazon, and PayPal, unreachable across the United States and Europe for much of the day. The original authors were not charged for the Dyn attack, which was carried out by others using the by-then-public code.

Who Created the Mirai Botnet?

Mirai was created by three young men: Paras Jha (21, of Fanwood, New Jersey), Josiah White (20, of Washington, Pennsylvania), and Dalton Norman (21, of Metairie, Louisiana). Jha and White had co-founded Protraf Solutions, a company that sold DDoS mitigation. According to the U.S. Department of Justice, the pair ran a protection racket, attacking organizations with Mirai and then offering to defend them, while leasing the botnet to other criminals for DDoS and click fraud.

Jha, who used the alias "Anna-senpai," published Mirai's source code at the end of September 2016 to create plausible deniability before investigators could tie the code to him. At its peak, the botnet controlled more than 300,000 devices. Brian Krebs traced the malware to Jha in early 2017, and the FBI built the case. 

In December 2017, all three pleaded guilty to conspiracy under the Computer Fraud and Abuse Act, and in September 2018, a court sentenced them to five years of probation and 2,500 hours of community service after they cooperated extensively with the FBI on other cybercrime investigations.

Mirai Source Code and Variants

Publishing the source code turned a single botnet into a template that anyone could copy and modify. Hundreds of forks followed, and researchers now track more than 116 distinct Mirai branches drawn from over 21,000 malware samples. The table summarizes notable variants and what each added.

The trend across these variants is clear: each generation exploits newer vulnerabilities, supports more device types, and adds money-making functions beyond DDoS. That adaptability is why a decade-old codebase still drives a large share of today's botnet activity.

Is the Mirai Botnet Still Active?

Yes. Mirai remains one of the most active botnet families nearly a decade after its debut, and its activity is growing rather than fading. Akamai's threat researchers continue to document fresh Mirai variants exploiting newly disclosed flaws in IoT devices, and Cloudflare attributed a record 5.6 Tbps DDoS attack in early 2025 to a Mirai-based botnet of more than 13,000 devices.

Three forces keep Mirai alive. First, the open source code lets new operators launch a botnet with little skill, and ready-made botnets are rented through Telegram and Discord. Second, the supply of vulnerable devices keeps growing, with cheap routers and cameras shipping with weak defaults and little patching. Third, modern variants automate the exploitation of known CVEs, weaponizing public vulnerability disclosures within days. 

Law enforcement has pushed back, with the U.S. Department of Justice disrupting Mirai-lineage botnets such as Aisuru and KimWolf in 2026, yet dismantled operations tend to re-emerge under new names.

How to Protect Against the Mirai Botnet

Defending against Mirai means removing the weaknesses it depends on. The following steps harden IoT devices against conscription:

• Change default credentials immediately. Replace every factory username and password with a strong, unique one before connecting a device to the internet. This single step defeats Mirai's primary infection method.
• Disable Telnet, SSH, and remote management. Turn off remote-access protocols and close unused ports, especially Telnet on ports 23 and 2323.
• Update firmware and patch promptly. Apply manufacturer updates that fix the CVEs modern Mirai variants exploit, and replace devices that no longer receive security patches.
• Segment IoT devices. Place cameras, routers, and smart devices on a separate network or VLAN so a compromise cannot spread to critical systems.
• Disable UPnP. Universal Plug and Play can expose devices to the internet automatically, so turn it off unless it is required.
• Monitor outbound traffic. Watch for unusual connections, scanning behavior, or traffic on port 23, which can signal an infected device.
• Use DDoS mitigation for public services. Organizations that could be targeted can route traffic through a DDoS protection service that absorbs volumetric floods.

Rebooting an infected device clears Mirai from memory, but the device is reinfected within minutes unless its credentials and firmware are fixed first. Secure the device, then reboot.

Signs of a Mirai Botnet Infection

Mirai is designed to run quietly, so infection is easy to miss. Several symptoms can point to a compromised device:

• Sluggish performance or frequent freezing, as the malware consumes processing power.
• Unusual bandwidth spikes or higher data usage from scanning and attack traffic.
• Overheating while the device is idle.
• Unexpected reboots or crashes, and changed settings.
• Outbound connections on port 23 or to unfamiliar IP addresses.

To clean a suspected device, disconnect it from the internet, perform a factory reset, update the firmware, and set new credentials before reconnecting. Devices past their support life warrant replacement.

How CloudSEK Helps Track IoT Botnet Threats

Stopping a botnet like Mirai depends on seeing it early, both as a threat in the wild and as exposure on an organization's own devices. CloudSEK Threat Intelligence tracks IoT and Mirai-based botnets, their variants, command-and-control infrastructure, indicators of compromise, and the CVEs they weaponize. CloudSEK's own research on the Ttint IoT botnet, a Mirai-derived strain, and on the more recent RondoDox campaign shows this intelligence in practice, mapping how operators exploit router and camera vulnerabilities to enroll devices.

That intelligence pairs with attack-surface visibility. CloudSEK BeVigil discovers an organization's internet-facing devices, open ports, and unpatched CVEs, surfacing the exposed routers, cameras, and appliances a botnet would target before it reaches them. Together, the two give security teams early warning of the threat and a map of their own exposure. CloudSEK does not provide DDoS scrubbing; its role is the intelligence and external-exposure visibility that helps organizations reduce the risk of conscription and anticipate attacks.

Frequently Asked Questions

What is the Mirai botnet in simple terms?

Mirai is malware that breaks into poorly secured smart devices, such as routers and cameras, by guessing their default passwords, then links them into a large network used to flood websites with traffic and knock them offline.

How many devices did Mirai infect?

At its 2016 peak, the original Mirai botnet controlled more than 300,000 devices. Across its variants, researchers have since tracked over 21,000 malware samples and more than 116 distinct branches.

What does "Mirai" mean?

Mirai is the Japanese word for "future." The malware's author used the online alias "Anna-senpai," and the name became attached to the code released in 2016.

Is Mirai a virus or a worm?

Mirai functions as a worm. It self-propagates by scanning the internet for vulnerable devices and infecting them without user interaction, unlike a virus, which needs a host file or human action to spread.

How do I remove Mirai from my device?

Disconnect the device, perform a factory reset to clear the in-memory infection, update its firmware, and set a strong, unique password before reconnecting. Without new credentials and patches, the device is reinfected quickly.

What is the difference between Mirai and a regular botnet?

A botnet is any network of infected devices under one operator's control. Mirai is a specific malware family that builds botnets from IoT devices using default-credential attacks, rather than from PCs or servers.