Daily Summary
Mirai sample volume rose to 100 today, a 17% increase over the 7-day average of 86 and the third consecutive day of above-average activity. While the uptick is not dramatic, the composition of today’s samples reveals a notable shift in architecture targeting that warrants attention.
New Samples Detected
Today’s sample set shows a deliberate expansion beyond Mirai’s usual x86 and ARM core. The breakdown - 16 .elf, 8 .arm7, 8 .arm5, 7 .x86, 7 .mips, and 4 each for .sh, .arm64, .m68k, .mpsl, and .mipsel - indicates broad cross-compilation rather than a focused campaign against specific device classes. The even distribution across nine architectures mirrors the build matrices seen in public Mirai source forks that have been circulating on underground forums since mid-2025.
What stands out is the double-digit .elf count. Generic ELF binaries are commonly staged for later obfuscation or repacking, and their prevalence today suggests the operator is preparing a multi-stage infection chain. The presence of .sh scripts at 4 samples also hints at downloader-style initial access, where the bot is fetched via wget or curl after a shell exploit.
IOC Highlights
All 100 samples are newly registered IOCs, with hashes now available for blocklisting. This is a high-yield day for signature updates compared to the typical 60-70 new IOCs per day over the past week. SOC teams should prioritize ingesting these into network and endpoint detection layers, as the cross-architecture spread means any unpatched IoT device could be a target regardless of vendor.
Security Analysis
The lack of new C2 infrastructure today, despite the sample surge, points to a reuse of existing command-and-control pools. This is consistent with the behavior of one known group that rotates through a set of roughly 20 IPs across Eastern Europe and Southeast Asia, avoiding fresh domain registrations to evade reputation-based blocking. The architecture sprawl in today’s samples is a deliberate hedge: by compiling for every major IoT CPU, the operator maximizes blast radius in a single push rather than iterating per device class.
Actionable recommendation: Deploy a network-level allowlist for outbound connections from IoT segments. Mirai variants are predictable in their C2 heartbeat patterns - typically a single TCP connection every 30 to 60 seconds on non-standard ports. Alert on any device that attempts to establish outbound connections to previously observed C2 IPs, even if the destination is not on a blocklist yet. This behavior-based detection will catch infections before the first scanning burst, which is where most Mirai operations begin to escalate.