Family
IranBot
A Mirai fork the industry detects and won't name. Its author signs the binary with a joke, and they still file it under the usual heading.
IranBot is a Mirai fork, and one of the kind that has a name of its own: there’s a public dossier with its markers, and they’re unmistakable. The author left a joke inside the binary —Not a mirai at all— along with a political slogan, and named the files with an iran. prefix.
That last part is worth stating in full, because it’s the first thing people misread: those are strings he wrote. They serve to identify the family and nothing else. They don’t say where it comes from, who pays for it, or where it’s run from.
And dossier or no dossier, the industry doesn’t name it: the engines that detect it file it under the usual heading. Inside, it delivers what the lineage promises —a telnet scanner with factory passwords, self-replication, an attack arsenal— so what’s interesting isn’t what it hides. It’s what it doesn’t bother to hide.
Here we catch it coming in over telnet, and then go looking for who it answers to.
- 21
Introduced by its enemy
An automated scanner found the honeypot's telnet and, eighteen seconds later, there was a binary inside. The password was «telnet». The loader it dropped comes with two operator typos, one of which breaks an entire infection. And when I finally put a name to the family —IranBot, a Mirai fork with a public dossier— it turned out that name had been written on this blog since August: a rival bot had put it there, in the list of competitors it uninstalls on arrival.
IranBot
2026-09 - 22
The twin I was missing
A bot of the Mirai school carries the address of whoever gives it orders. I looked for this one's by four different routes and found it by none — and along the way I published a theory of my own that turned out to be false. What finally worked wasn't a better tool: it was realising that somewhere out there sat another binary, compiled from the same code, whose command centre somebody had already published. With both in front of me, the difference between them is one thousand one hundred and thirty bytes.
IranBot
2026-09