Family
Mirai
The botnet that took down half the internet in 2016. What landed here was “milnetv4”, config encrypted with a single byte and a key that gave itself away.
Mirai burst onto the scene in 2016 and changed the game: with it, tens of thousands of cameras and home routers took down half the internet. When its source leaked it became —alongside Gafgyt— the other great lineage behind almost all IoT botnet malware.
Its technical signature is recognizable: it compiles the same bot for a dozen CPU architectures, disables the device’s watchdog so it can’t reboot and clean itself, sweeps /proc to kill the competition, and takes its attack orders as numeric opcodes from a command server.
Here we catch it alive, follow its trail to its delivery server, and open it with Ghidra all the way to its full arsenal.
- 03
The botnet that left its code out in the open
Another one walks in and drops its critter. But this one left a door open on its own delivery server — and inside was the source code. A multi-architecture Mirai, caught red-handed.
Mirai
2026-08 - 04
Mirai laid bare: 16 methods and a one-byte XOR
The bot from the last chapter kept its config encrypted and its orders under lock and key. Ghidra spills the lot: the decryption (a laughable XOR), the botnet's real name, its C2 protocol and its full arsenal — without handing out weapons.
Mirai
2026-08 - 17
Fresh out of the oven
A quiet Sunday, my new-binary alarm went off after days of silence. The first thought was the best one there is: something fresh. What followed was a rollercoaster — an old acquaintance, a false positive that nearly fooled me, and finally a critter that wasn't in any public repository, caught less than thirty hours after it was born.
Mirai
2026-08