Mirai-Based Botnets Evolve Into Massive DDoS and Proxy Abuse Threat
## Cybersecurity: Evolution of Mirai-Based Botnets
Cybersecurity: Evolution of Mirai-Based Botnets
The proliferation of botnet-driven threats has been notable over the past year, primarily linked to the Mirai malware family. Initially identified in 2016, Mirai targets Internet of Things (IoT) devices using ARC processors with a basic Linux operating system. This malware exploits known vulnerabilities or default credentials to access these devices.
Originally designed for Distributed Denial of Service (DDoS) attacks, Mirai has evolved into a complex threat ecosystem. The public release of its source code has enabled numerous variants, increasing the number of command and control (C2) servers by 26% in the first half of 2025 and 24% in the latter half, according to Spamhaus data. Notably, the United States now hosts more C2 servers than any other country.
Significant Mirai-based botnets include Aisuru and Kimwolf, collectively known as Aisuru-Kimwolf. These variants have compromised between one and four million devices globally. Cloudflare has documented DDoS attacks by Aisuru-Kimwolf reaching up to 31.4 terabits per second and 14.1 billion packets per second.
The operators of Aisuru-Kimwolf commercialize access to compromised devices via platforms such as Discord and Telegram. On Mar 19, 2026, the U.S. Department of Justice conducted operations against the C2 servers of several botnets, including Aisuru and Kimwolf, in collaboration with Canadian and German authorities. Despite these efforts, the botnets continue to adapt, utilizing residential proxy networks to obscure attack origins.
The proliferation of botnet-driven threats has been notable over the past year, primarily linked to the Mirai malware family.
Technical Analysis: Kimwolf's Mechanisms
Kimwolf, a subvariant focused on Android devices and Smart TVs, has infected approximately two million devices. It utilizes DDoS functionalities similar to Aisuru but is specifically adapted for Android systems. The infection process involves executing scripts that download and run .apk files from attacker-controlled servers, targeting multiple CPU architectures.
Following disruptions to the IPIDEA proxy infrastructure, Kimwolf operations shifted to The Invisible Project (I2P), a decentralized network designed to anonymize traffic, underscoring the botnet's resilience against enforcement actions.
Implement DDoS protection solutions to identify and block malicious traffic. Utilize DNS filtering services to intercept suspicious domain queries. Regularly patch network devices and replace default credentials with strong passwords during setup.
Based on reporting by Cyber Security News.