Loading story…
New variants of the Mirai and Gafgyt IoT/Linux botnets were observed expanding from consumer devices to enterprise-facing systems by exploiting known vulnerabilities in Apache Struts and SonicWall Global Management System. Palo Alto Networks Unit 42 reported that a Mirai sample targeted CVE-2017-5638, the remote code execution flaw in Apache Struts tied to the Equifax breach, marking the first known case of Mirai using that exploit in the wild.
A Gafgyt variant was also seen exploiting CVE-2018-9866 in older, unsupported SonicWall GMS versions shortly after a Metasploit module for the bug became public. Researchers linked both malware families through infrastructure involving l[.]ocalhost[.]host and said the Mirai sample carried 16 exploits in total, while the Gafgyt sample included scanning and DDoS capabilities such as Blacknurse, underscoring a broader shift by IoT/Linux botnets toward outdated enterprise targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On September 7, 2018, Unit 42 found Mirai samples incorporating exploits for 16 vulnerabilities, including CVE-2017-5638 in Apache Struts. Unit 42 described this as the first known instance of Mirai targeting an Apache Struts vulnerability.
Unit 42 said Gafgyt samples exploiting CVE-2018-9866 first surfaced on August 5, 2018. The malware targeted older SonicWall GMS versions and was hosted on infrastructure later linked to localhost[.]host.
During part of August 2018, l[.]ocalhost[.]host resolved to 185[.]10[.]68[.]127. Unit 42 observed that IP hosting Gafgyt samples exploiting the SonicWall GMS vulnerability.
SonicWall published a public advisory for CVE-2018-9866, a flaw affecting older unsupported Global Management System versions. Unit 42 later tied Gafgyt exploitation activity to this vulnerability.
Unit 42 said the earliest samples they had seen supporting Blacknurse dated to September 2017. This established that the DDoS capability later found in the SonicWall-targeting Gafgyt variant had been present in related malware for at least a year.
Unit 42 said the domain l[.]ocalhost[.]host had been associated with Mirai activity as far back as November 2016. The same domain later appeared in infrastructure tied to the newly observed Mirai and Gafgyt variants.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that multiple **Gafgyt/Bashlite** variants targeting IoT devices are reusing leaked **Mirai** source code while continuing to evolve their infection and attack capabilities. Analyses found shared modules for **HTTP, UDP, and TCP flooding**, a telnet brute-force scanner, and other botnet functions, alongside exploitation of known router flaws including `CVE-2017-17215`, `CVE-2014-8361`, and `CVE-2018-10561`. Separate reporting also described campaigns abusing exposed **SSH**, **Telnet**, and **WeMo UPnP** services to drop first-stage shell scripts and architecture-specific ELF payloads that conscript devices into distributed denial-of-service operations. Recent samples show operators tailoring payloads for stealth and persistence after compromise. One analyzed ELF binary, packed with **UPX** and masquerading as `/usr/bin/apt`, was observed beaconing to `45.61.186.4:13561`, killing rival malware, flushing `iptables`, stopping local firewall services, clearing shell history, and altering DNS settings before accepting commands for **TCP, UDP, GRE, ICMP, HTTP, and game-server-focused floods**. Other reports noted process renaming, heavy forking, changing filenames and infrastructure, and added backdoor or cryptomining functions, indicating that Gafgyt operators are using modular, frequently modified malware to evade detection and sustain IoT-focused DDoS campaigns.
Aug 15, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
Researchers reported multiple fast-moving IoT/Linux botnet campaigns built from **Mirai** and **Gafgyt** code that aggressively targeted embedded devices through known vulnerabilities and, in some cases, credential brute forcing. Palo Alto Networks said the campaigns—linked to evolutions of **Omni**, **Okane**, and **Hakai**—combined as many as 11 exploits in a single sample and introduced new distributed denial-of-service techniques, while related **Gafgyt** malware added an `HTTPCF` Layer 7 attack command aimed at Cloudflare-protected URLs. One newly adopted vector was the unauthenticated remote command execution flaw in **D-Link DSL-2750B** routers, which attackers incorporated shortly after public exploit tooling became available. The activity mirrors earlier reporting on **IoT_reaper**, a rapidly spreading botnet that also favored exploit-driven propagation over Mirai-style weak-password attacks. Netlab 360 said Reaper integrated at least nine exploits across products from **D-Link, Netgear, Linksys, AVTECH, GoAhead, JAWS,** and **Vacron**, maintained multiple command-and-control components, and at one point showed more than 10,000 daily active bot IPs on a tracked server, with millions of vulnerable devices queued for infection. Together, the reports show botnet operators quickly weaponizing public disclosures and modules to compromise internet-exposed routers and cameras at scale, then repurposing those infections for DDoS and broader botnet operations.
Aug 15, 2026