Daily Summary
Mirai activity surged to 100 new samples on 2026-10-11, a 250% increase over the 7-day average of 29. This is the largest single-day volume in the observation window and marks a clear departure from the baseline cadence of the past week. No new C2 infrastructure was registered, which makes the spike in payload volume the defining feature of today’s data.
New Samples Detected
The 93 .elf samples dominate today’s corpus, consistent with Mirai’s Linux-first targeting of routers, DVRs, and IP cameras. Less typical is the small but persistent presence of non-x86 builds: 2 .ppc (PowerPC) and 1 .x86_64 alongside 2 .bin and 2 .sh scripts. PowerPC builds are uncommon in commodity Mirai dumps and typically point to either a broader architecture matrix in the build pipeline or targeting of legacy embedded devices (NAS units, older routers) that still ship PPC cores. The two shell scripts are likely loader or persistence stagers rather than standalone binaries.
7-Day Trend
Today’s count deviates far beyond the 25% threshold that would normally trigger scrutiny, sitting at 3.4x the weekly average. Such spikes are rarely organic: they usually reflect either a single actor mass-producing variants, a build system dumping a batch of architecture-specific binaries at once, or a fresh recruitment phase ahead of a larger campaign. The absence of new C2 servers suggests this is a payload-generation or staging phase, with command infrastructure already in place from prior activity.
IOC Highlights
All 100 IOCs are new, but with zero new C2 servers, the indicator value is concentrated in file hashes and embedded strings rather than network infrastructure. Defenders should pivot on binary hashes rather than expect novel C2 endpoints. The architecture spread (.elf, .ppc, .x86_64) means hash-based detection alone will miss sibling builds from the same source tree.
Security Analysis
The combination of a 250% volume spike, zero new C2, and a heterogeneous architecture mix is the tell. In known Mirai campaigns such as the original 2016 release and the subsequent Mozi and Gafgyt overlaps, batch builds across multiple CPU architectures are typically compiled once and deployed gradually, with infrastructure reused across waves. Today’s pattern fits that template: a single build session produced binaries for several architectures, and they are being seeded before the next exploitation push. The two shell scripts reinforce this, serving as delivery wrappers for the binaries. Defensive recommendation: do not treat the lack of new C2 as a sign of low risk. Instead, hunt on the ELF samples’ shared code characteristics (init strings, default credential lists, and embedded architecture checks) and deploy YARA rules across the whole family rather than per-architecture signatures. Blocking only x86_64 will leave the PPC and generic ELF builds active on embedded estates.