M is for Mirai — The Botnet the Honeypot Watches Being Born, Every Day

The Alphabet of Actors — Letter M. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED, CAUGHT, EVOLVING, TAKEN DOWN, IMMORTAL.

Every letter in this register ends with a bridge — a passage that carries the actor to what the LSN systems catch of its kind today. For most of them that bridge is an analogy: the honeypot sees a commodity version of what the profiled actor did at a higher level. For Mirai, there is no analogy, because there is no distance to bridge. The honeypot does not see a commodity version of Mirai. It sees Mirai — or rather Mirai's countless descendants — in bulk, continuously, as the single largest component of its daily traffic. This is the one actor in the alphabet whose primary evidence is not a document in the archive but the platform's own sensors, and whose genus the honeypot exists, in substantial part, to watch.

Mirai is the botnet that weaponised the Internet of Things. In 2016 it took the exploding population of cheap, internet-connected devices — the security cameras, the digital video recorders, the home routers that had quietly multiplied into the hundreds of millions — and turned them into a distributed-denial-of-service army. And it did so with the least sophisticated attack in this entire register. It did not exploit a clever vulnerability. It scanned the internet for devices with the telnet port open and tried a short list of factory-default passwords — admin/admin, root/root, and a few dozen more that manufacturers had shipped and owners had never changed. That was the whole attack. The genius, such as it was, belonged to arithmetic: try a known password against a population of ten million identical unlocked doors, and enough of them open to build a weapon.

This is the letter about the dumbest attack that ever took down the internet, about the economics that make it unfixable, and about the two facts that define Mirai's fate: its authors were among the very few actors in this register actually caught and convicted, and it did not matter at all, because they had already set the thing free.

1. The Actor: an army of unlocked doors

To understand Mirai you have to understand its raw material, which is not malware but a market failure at planetary scale. In the years leading up to 2016, the world filled with cheap internet-connected devices — IP cameras to watch the driveway, DVRs to record them, routers to connect them, a vast and growing population of small computers that their owners did not think of as computers at all. They were manufactured to a price, shipped with default administrative passwords printed in the manual, often with a telnet service listening on the open internet, and almost never updated, because there was no update mechanism and no one to run it. Each device was, functionally, a small Linux server with a known password and no one guarding it.

Mirai's insight was to treat that population as one addressable target. Its code scans the internet at high speed for devices with telnet open, and against each one it tries a built-in list of the factory-default credential pairs that these devices ship with. When a login succeeds — and across ten million identical devices, it succeeds constantly — the device is conscripted: a small payload is loaded, the device reports to a command-and-control server, and it joins the botnet, where it does two things. It waits for orders to flood a target with traffic, and, in the meantime, it scans the internet for more devices to recruit, exactly as it was itself recruited. The botnet grows itself.

There is no exploit in any of this, and that is the point worth sitting with, because it inverts the usual hierarchy of threat. The register has profiled apex actors who reflashed firmware and chained zero-days. Mirai did none of that. It guessed passwords the manufacturer had left in the box. And it assembled, from that trivial technique, a weapon that the apex actors' sophistication could not match in raw destructive scale, because the source of its power was never cleverness. It was the sheer number of insecure devices, and there were more of those than anyone had defended against.

2. The Instrument: the day the webcams took down the web

The scale became undeniable in the autumn of 2016, in three events that are now landmarks in the history of the internet. First, a record-breaking flood of roughly 620 gigabits per second struck the website of the security journalist Brian Krebs, so large it knocked his site off its long-standing protection. Then an attack estimated near a terabit per second — among the largest ever recorded at the time — hit the French hosting company OVH. These were demonstrations, and they were shocking on their own. But it was the third event that changed how the world understood the threat.

In October 2016, Mirai was pointed at Dyn, a major DNS provider — one of the companies that runs the internet's address book, translating names like twitter.com into the numbers machines actually use. Take down a DNS provider and you do not take down one site; you take down everyone who depends on it to be found. And so, for hours across a day, large parts of the United States internet degraded or went dark: Twitter, Netflix, Reddit, Spotify, GitHub, and a long list of others became slow or unreachable, not because those services were attacked but because the thing that helped people find them was buried under traffic from hijacked cameras and DVRs.

Read that sentence again, because it is the whole significance of Mirai. The infrastructure of the modern internet — the services used by hundreds of millions of people, run by some of the most capable engineering organisations on earth — was disrupted by an army of the cheapest, weakest, least-secured devices on the network. The webcam watching an empty driveway in one country helped knock a streaming service offline in another. Mirai proved that the security of the internet is not determined by the strength of its strongest nodes but by the weakness of its weakest ones, because the weakest ones can be conscripted, by the millions, into a weapon aimed at the rest.

3. The Externality: the harm nobody who could stop it pays for

Beneath the spectacle is an economics problem, and it is the deepest thing this letter has to say, because it explains why Mirai is not a solved historical incident but a permanent condition. Mirai is a textbook negative externality — a harm displaced from the parties who could prevent it onto the parties who cannot.

Trace the incentives. The manufacturer that shipped the camera with a default password and no update mechanism chose the cheapest option, sold the device, and bears no cost when that device is later conscripted into a botnet — it has the money and none of the liability. The consumer who bought the camera and never changed the password bears no visible cost either, because the camera still shows the driveway perfectly well while it is attacking a DNS provider on the other side of the world; the owner does not know, and would not feel it if they did. Every party who could actually prevent the harm — at the factory or on the shelf — has no incentive to, because the cost of the harm lands entirely on someone else: on Dyn, on Krebs, on the whole internet that absorbs the flood. The people who could unload the gun do not pay when it goes off, and the people who pay cannot reach the gun.

That is why the market has not fixed it and will not, and the proof is in this very archive. The CVE list holds entries from 2025 and 2026 — CVE-2025-7503, an IP camera with 'undocumented, default credentials' on a telnet service 'enabled by default' giving 'root-level shell access'; CVE-2026-10045, a router with 'hardcoded login credentials' and 'telnet enabled by default.' A decade after Mirai, manufacturers are still shipping the exact flaw Mirai was built to exploit, because nothing in the market makes them stop. The recruitment surface is not shrinking with time. It is being restocked, model by model, year by year, by an industry that pays no price for the ammunition it manufactures.

4. The Immortality: how a botnet becomes a genus

Mirai the operation could have been a single, bounded story — a botnet, an operator, a takedown, an ending. What made it permanent was one deliberate act. In late September 2016, before the authors were identified, Mirai's source code was published openly on a criminal forum, under the handle 'Anna-senpai.' And with that publication, Mirai stopped being a botnet and became a genus.

A published, working botnet with an inexhaustible target population does not get shut down; it speciates. In the years since the release, hundreds of forks have been built on the Mirai base — Satori, Okiru, Masuta, Mozi, and countless unnamed variants — each one taking the original default-credential recruitment engine and bolting on new device exploits, new target lists, new command infrastructure. These are not tributes to Mirai or resurgences of it. They are Mirai, forked and re-armed, running on the same endless supply of insecure devices. The honeypot that watches them cannot always tell one variant from another and largely does not need to, because they are members of a family, and the family is the actor.

This is where Mirai joins a pattern the register has traced twice before, and completes it. Equation Group (Letter E) hoarded an arsenal that was stolen and leaked, and the world inherited its weapons. Hafnium (Letter H) burned a zero-day in indiscriminate mass exploitation, and the whole ecosystem fed on the mess. Mirai is the third and purest face of the same phenomenon: its authors did not have their tools stolen and did not merely use a flaw at scale — they published the source themselves, deliberately, and made the capability everyone's forever. All three end in proliferation, but Mirai's is the most complete, because the release was intentional and the habitat is limitless. You cannot recall published code, and you cannot patch a hundred million insecure devices. A botnet made immortal by publication, feeding on a device population made immortal by market failure, does not have an end state. It has a steady state, and the honeypot measures it every day.

5. The Accountability: caught, convicted, and it changed nothing

Here Mirai gives the register something it has almost never had — a genuine, adjudicated conviction of the actual perpetrators — and then, in the same breath, shows why even that was not enough.

Mirai's authors were not sheltered state operators behind a hostile border, and not Russia-based criminals beyond extradition. They were young men in the United States. Paras Jha, Josiah White and Dalton Norman were identified, charged, and in late 2017 pleaded guilty to the Mirai conspiracy; they cooperated extensively with the FBI, in some accounts helping investigators pursue other cybercriminals, and were sentenced without the lengthy prison terms their conduct might otherwise have drawn, in recognition of that cooperation. Set that against the rest of this register — the Chengdu 404 men who will never be tried, the GRU officers photographed and sanctioned and untouched, Kimsuky's operators beyond any court, the Russia-based ransomware bosses relaunching within days of exposure. Mirai is the case where consequence actually reached the people who built the thing, and the reason is the one this register keeps finding: reachability, not culpability. The authors were within a jurisdiction that could arrest them, so it did.

And it changed the botnet by nothing. This is the quiet tragedy of the letter, and the limit of even real justice against this modality. By the time the authors were caught, the source was already public and the devices already vulnerable, so the two things a conviction cannot do — un-publish the code and secure a hundred million cameras — were exactly the two things that would have been required to stop the genus. You can convict the arsonist; you cannot un-burn the forest. And in this case the forest regrows itself, from seeds the arsonist scattered before he was caught, in soil the manufacturers keep fertilising. The conviction was real, and just, and satisfying, and it is still, a decade later, brute-forcing the honeypot's telnet port right now.

6. The counter-narrative, steelmanned

The case for keeping Mirai in proportion is worth making, because a botnet of webcams can be dismissed as unglamorous nuisance rather than serious threat.

Mirai is just DDoS, the argument runs — disruptive, but not destructive. It does not steal secrets like the state actors, does not extort like the ransomware crews, does not surveil dissidents like the spyware vendors; it floods services with traffic, they fall over for a few hours, and then they come back, with no data lost and no lasting damage. The Dyn outage was a bad afternoon, not a catastrophe. And the problem, the argument continues, is genuinely being addressed: newer devices increasingly ship with unique per-device passwords rather than universal defaults, some jurisdictions have passed IoT security laws banning default credentials, and the technique is crude and well-understood. Treating a decade-old webcam botnet as a top-tier actor, on this account, is nostalgia — the real threats moved on, and the defences against this one improved.

The dossier grants the narrow points and rejects the conclusion. Yes, DDoS is disruptive rather than destructive in the immediate case; yes, some regulation and some better defaults have arrived. But 'just DDoS' undersells the stakes in a world where availability is safety — a DDoS against a hospital's systems, an emergency service, a financial exchange, or the DNS the whole internet depends on is not a bad afternoon, and Mirai proved a webcam army can reach exactly those targets. And the 'it's being fixed' optimism is refuted by the archive it is being argued against: the CVEs in this corpus show default-credential telnet devices still shipping in 2025 and 2026, which means the regulation is partial, the better defaults are not universal, and the recruitment surface is being actively restocked faster than it is being secured. Most of all, the counter-narrative measures the wrong thing. Mirai's significance was never one botnet's raw output; it was the demonstration of a structural truth — that the internet's security floor is set by its weakest devices, that those devices are a permanent and growing population, and that the economics guarantee no one responsible will fix them. That truth did not age. It is truer now, with more devices, than it was in 2016.

7. Verdict — CONVICTED, and IMMORTAL

Mirai took the weakest things on the network — the cheap camera, the forgotten DVR, the unpatched router — and proved they could be assembled, by the simplest trick imaginable, into a weapon that darkened the internet for millions. It exposed an externality no market will close, published itself into a permanent genus, and left a habitat of insecure devices that its authors' arrest could not shrink and that manufacturers keep replenishing to this day. And of all the actors in this register, it is the one whose genus the platform beneath these words watches recruit, in real time, as its ordinary daily traffic.

The verdict's first word is the rare one this register almost never gets to write about the people responsible: CONVICTED. Mirai's authors were identified, pleaded guilty, and faced real, adjudicated justice — not because their crime was smaller than the sheltered actors' but because they were reachable, young men inside a jurisdiction that could hold them to account. In an alphabet full of the untouchable, Mirai is a genuine instance of consequence landing where it belonged.

The second word is why the conviction, though real, solved nothing: IMMORTAL. The authors were caught; the genus was already free. The source is public and cannot be recalled; the vulnerable devices number in the hundreds of millions and cannot be patched; and the manufacturers restock the supply every year, as the 2025 and 2026 CVEs in this very archive attest. Mirai does not have an ending, because you cannot convict a genus and you cannot arrest an externality. It has a steady state — a constant, background recruitment that the honeypot registers as tens of thousands of default-credential login attempts, day after day, from an ever-shifting cast of infected devices, world without end.

Fifteen letters in, Mirai is the register's most honest mirror of what a honeypot is actually for. Not to catch the apex predator or name the state operator, though the platform does both; but to sit at the bottom of the internet and measure, continuously, the weather of its weakest devices being turned against it. Every other letter's actor had to be researched. This one just has to be watched, because it never stops. The vectors do not lie: the attack is trivial, the scale is planetary, the authors were caught, the genus lives on, the devices keep shipping. Judge the botnet that guessed the passwords the manufacturers left in the box. Then judge the market that keeps leaving them there — and note that the honeypot's telnet port is being tried, by one of Mirai's children, in the time it took to read this.

The Alphabet of Actors continues. Verdict: CONVICTED, and IMMORTAL. Confidence: HIGH throughout — the modality, the attacks, the source release, the conviction and the ongoing recruitment are public record and, uniquely, measured directly in the LSN honeypot's own telemetry, with the recruitment surface documented in the archive's 2025-2026 default-credential IoT CVEs. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the botnet, and the market that keeps building its army for it.