Loading story…
Trend Micro disclosed a Mirai variant in May 2019 that combined 13 exploits targeting routers, surveillance devices, and the ThinkPHP framework. Detected as Backdoor.Linux.MIRAI.VWIPT, the malware supported backdoor access, distributed denial-of-service attacks, and credential brute forcing. Researchers described it as the first observed Mirai campaign to combine all 13 exploits, although those exploits had appeared in earlier attacks. The variant used three XOR keys to encrypt data, with a command-and-control endpoint at 35[.]235[.]102[.]123:1337 and download and dropper URLs hosted under a hopto[.]org domain.
The discovery complemented Unit 42 reporting on Mirai and Gafgyt IoT/Linux botnet campaigns, highlighting the continued use of vulnerable connected devices as botnet infrastructure. Trend Micro recommended applying security patches and evaluating manufacturers’ security practices and update consistency before connecting devices to networks. Defenders should prioritize exposed routers and surveillance equipment for vulnerability assessment and remediation, while treating the reported infrastructure as historical indicators rather than evidence of current activity.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
In 2018, the Omni Mirai variant used 11 of the exploits later found in Backdoor.Linux.MIRAI.VWIPT. Its exploit set did not include the Linksys or ThinkPHP vulnerabilities.
An IoT honeypot led researchers to Backdoor.Linux.MIRAI.VWIPT, identified as the first Mirai campaign to combine all 13 listed exploits targeting routers, surveillance devices, and ThinkPHP. Analysis revealed backdoor and DDoS capabilities, credential brute-forcing, three XOR encryption keys, and associated command-and-control and payload infrastructure.
A subsequent Mirai attack used Linksys and ThinkPHP exploits alongside CVE-2018-10561, CVE-2014-8361, a UPnP SOAP TelnetD command execution vulnerability, and CVE-2017-17215.
Earlier reporting identified the Mirai variant Yowai exploiting remote code execution vulnerabilities in CCTV-DVR products and ThinkPHP.
Earlier reporting identified the Gafgyt variant Hakai exploiting CVE-2015-2051 in D-Link devices and a ThinkPHP remote code execution vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026
Trend Micro researchers identified a Mirai variant, detected as `IoT.Linux.MIRAI.VWISI`, that exploits nine vulnerabilities affecting connected devices and web software. The July 2020 report highlighted its use of `CVE-2020-10173`, an authenticated command-injection vulnerability in Comtrend VR-3033 routers, which the researchers had not previously observed being exploited by Mirai variants. The malware also attempts Telnet and SSH credential brute-forcing, concealing its credential dictionary with XOR encoding using the key `0x04`. The variant combines vulnerability exploitation with password attacks, exposing organizations with unpatched devices or weak remote-access credentials to botnet compromise. Trend Micro published a sample SHA-256 hash and two command-and-control domains to support detection and investigation. The researchers recommended prompt patching, network segmentation, strong passwords, and secure device configurations; organizations operating Comtrend VR-3033 routers should prioritize remediation of the command-injection flaw alongside hardening Telnet and SSH access.
Oct 9, 2026
Palo Alto Networks Unit 42 reported that a new **Mirai** campaign is targeting internet-exposed IoT devices by chaining multiple known exploits to compromise systems and pull them into a botnet. The activity focuses on broad opportunistic scanning and exploitation, continuing Mirai’s long-running pattern of abusing weakly secured embedded devices such as routers, cameras, and other Linux-based appliances. The campaign’s significance lies in its use of several IoT vulnerabilities rather than a single flaw, increasing the number of devices that can be infected and used for follow-on malicious activity such as distributed denial-of-service (**DDoS**) attacks. The report highlights the ongoing risk from unpatched and publicly reachable IoT infrastructure, underscoring the need for rapid patching, exposure reduction, and stronger hardening of embedded systems connected to the internet.
Jun 29, 2026