MALWARE FAMILY

Mirai

Internal ID: elf.mirai

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.

Threat Analysis

Mirai is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://osint.bambenekconsulting.com/feeds/

→http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/

→https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html

→https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/

→https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/

→https://blog.netlab.360.com/new-mirai-variant-with-dga/

→https://blog.netlab.360.com/rimasuta-spread-with-ruijie-0day-en/

→https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/

→https://blog.netlab.360.com/what-our-honeypot-sees-just-one-day-after-the-spring4shell-advisory-en/

→https://blog.netlab.360.com/wo-men-kan-dao-de-wu-ke-lan-bei-ddosgong-ji-xi-jie/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.mirai

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Mirai