Loading story…
Security researchers reported that the Reaper IoT botnet, also tracked as IoTroop, was spreading by exploiting known vulnerabilities in Internet-connected routers and cameras instead of relying mainly on default passwords as Mirai did. Check Point said the malware had already compromised roughly one million organizations, while Netlab 360 described its scanning as more selective and stealthy than Mirai’s, raising concern that Reaper could assemble a significantly larger botnet for future DDoS attacks or other malicious operations.
The malware was linked to exploits for at least nine published flaws affecting devices from vendors including Linksys, Netgear, D-Link, AVTECH, and products using vulnerable custom GoAhead-based camera software. Referenced weaknesses included older Linksys router vulnerabilities and severe camera flaws such as the WIFICAM issues assigned CVE-2017-8221 through CVE-2017-8225, which enabled pre-authentication compromise and root-level code execution. Researchers warned that large numbers of exposed, unpatched IoT devices remained reachable from the Internet, creating conditions for another Mirai-scale disruption unless organizations rapidly patch, isolate, or replace affected systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Netlab 360 published research on the malware it called Reaper, describing it as more deliberate and stealthy in scanning than Mirai and noting it borrowed some Mirai code while differing in key behaviors. The research also provided indicators of compromise, control-network locations, and vendor-specific patch information.
Check Point said it had been tracking a large new IoT botnet it called IoTroop and warned it represented a rapidly spreading global campaign. The company estimated the malware had already infected about one million organizations and was exploiting known IoT vulnerabilities rather than mainly default credentials.
Pierre Kim reported multiple severe vulnerabilities in OEM Chinese P2P/WIFICAM IP cameras affecting more than 1,250 models sold under many brands. The advisory described a chain leading to pre-authentication remote code execution as root and noted roughly 185,000 vulnerable cameras indexed by Shodan.
A Mirai variant was used in the attack on Dyn, disrupting access to major online services including Twitter, SoundCloud, Spotify, and Reddit. The incident highlighted the Internet-scale risk posed by IoT botnets.
KrebsOnSecurity was struck by the first known Mirai botnet in a 620 Gbps distributed denial-of-service attack. The attack became one of the early high-profile demonstrations of Mirai's impact.
An advisory covering multiple vulnerabilities in Linksys E1500/E2500 devices was published. Krebs later cited Linksys among vendors whose flaws were exploited by Reaper.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
krebsonsecurity.com
Open sourceresearch.checkpoint.com
Open sourcepierrekim.github.io
Open sources3cur1ty.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple fast-moving IoT/Linux botnet campaigns built from **Mirai** and **Gafgyt** code that aggressively targeted embedded devices through known vulnerabilities and, in some cases, credential brute forcing. Palo Alto Networks said the campaigns—linked to evolutions of **Omni**, **Okane**, and **Hakai**—combined as many as 11 exploits in a single sample and introduced new distributed denial-of-service techniques, while related **Gafgyt** malware added an `HTTPCF` Layer 7 attack command aimed at Cloudflare-protected URLs. One newly adopted vector was the unauthenticated remote command execution flaw in **D-Link DSL-2750B** routers, which attackers incorporated shortly after public exploit tooling became available. The activity mirrors earlier reporting on **IoT_reaper**, a rapidly spreading botnet that also favored exploit-driven propagation over Mirai-style weak-password attacks. Netlab 360 said Reaper integrated at least nine exploits across products from **D-Link, Netgear, Linksys, AVTECH, GoAhead, JAWS,** and **Vacron**, maintained multiple command-and-control components, and at one point showed more than 10,000 daily active bot IPs on a tracked server, with millions of vulnerable devices queued for infection. Together, the reports show botnet operators quickly weaponizing public disclosures and modules to compromise internet-exposed routers and cameras at scale, then repurposing those infections for DDoS and broader botnet operations.
Aug 15, 2026
Palo Alto Networks Unit 42 reported that a new **Mirai** campaign is targeting internet-exposed IoT devices by chaining multiple known exploits to compromise systems and pull them into a botnet. The activity focuses on broad opportunistic scanning and exploitation, continuing Mirai’s long-running pattern of abusing weakly secured embedded devices such as routers, cameras, and other Linux-based appliances. The campaign’s significance lies in its use of several IoT vulnerabilities rather than a single flaw, increasing the number of devices that can be infected and used for follow-on malicious activity such as distributed denial-of-service (**DDoS**) attacks. The report highlights the ongoing risk from unpatched and publicly reachable IoT infrastructure, underscoring the need for rapid patching, exposure reduction, and stronger hardening of embedded systems connected to the internet.
Jun 29, 2026
A renewed **Mirai** botnet campaign is targeting internet-exposed routers and IoT devices by exploiting known vulnerabilities, with advisories highlighting compromises affecting industrial routers, smart home systems, DVRs, cameras, and 5G/LTE equipment. Reported targets include devices from **ASUS, Huawei, Neterbit, LB-Link, Four-Faith, Kguard, Lilin,** and **Vimar**, as well as generic DVR platforms and PZT cameras, indicating broad opportunistic scanning of exposed edge infrastructure. National CERT advisories from Brunei and Colombia warned that Mirai-related botnet activity continues to threaten consumer and industrial environments, including routers and other connected devices. Defenders were urged to **patch exposed systems**, **disable remote access where possible**, **replace default credentials with strong unique passwords**, and **scan networks for vulnerable or internet-facing assets** to reduce the risk of botnet enrollment and downstream abuse such as distributed denial-of-service activity.
Aug 1, 2026