Loader / botnet
Mirai
Mirai is malware that turns internet-connected devices such as cameras and routers into a botnet used for distributed denial of service (DDoS) attacks. It found victims by scanning for devices with factory-default or weak Telnet passwords. Mirai-based botnets were used in very large DDoS attacks in 2016, including the attack on DNS provider Dyn, and its source code was published online that year, leading to many variants.
- Public attribution and associated actors
- In 2017 three US defendants pleaded guilty to charges related to creating and operating the Mirai botnet (US Department of Justice).
- First seen
- 2016
- Platforms
- Linux-based IoT devices
How it spreads or gets in
- Scanned the internet for devices with Telnet open and tried a built-in list of default usernames and passwords.
Key behaviours
- Loaded the bot onto compromised devices and reported them to a control server.
- Launched volumetric and application-layer floods on command.
- Lived only in memory, so a reboot cleared it until the device was reinfected (CISA).
ATT&CK techniques
- T1046Network Service Discovery
- T1110.001Brute Force: Password Guessing
- T1078.001Valid Accounts: Default Accounts
- T1105Ingress Tool Transfer
- T1498Network Denial of Service
- T1499Endpoint Denial of Service
Mapped to ATT&CK from the behaviour described in the cited sources; MITRE has no software entry for this family.
Detection ideas
- Watch for devices on your network scanning outward on Telnet ports.
- Alert on IoT devices making connections they never normally make.
- Use upstream DDoS monitoring to spot attacks early.
Defences that work
- Change default passwords before devices go online, and buy devices that force this.
- Disable Telnet and remote management on IoT devices, and keep firmware updated.
- Put IoT devices on their own network segment.
- Use a DDoS protection service for critical internet services.