Mirai Botnet.

An IoT malware family first seen in 2016 that recruits routers, cameras, and DVRs through default credentials and was used in the Dyn DNS DDoS that broke much of the U.S. internet. It belongs to the OT / ICS / IoT category of cybersecurity.

An IoT malware family first seen in 2016 that recruits routers, cameras, and DVRs through default credentials and was used in the Dyn DNS DDoS that broke much of the U.S. internet.

Mirai is an IoT malware family first identified in August 2016 that scans the internet for Linux-based devices — routers, IP cameras, DVRs — exposing Telnet (and later SSH) with a list of well-known default credentials. Infected devices report to a C2 server and can launch high-volume DDoS attacks, including HTTP, UDP, TCP-SYN, and DNS amplification. Mirai was used in the September 2016 attack on Brian Krebs's site (~620 Gbps), the October 2016 attack on DNS provider Dyn that disrupted Twitter, Spotify, Netflix, and many other services, and an attack on the French hoster OVH (>1 Tbps). The source code was released publicly in October 2016, spawning many forks (Satori, Okiru, Owari, Mozi). Three U.S.-based authors (Paras Jha, Josiah White, Dalton Norman) later pleaded guilty.

Defences for Mirai Botnet typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Mirai, Mirai malware.