Daily Summary
Mirai activity surged to 100 new samples on 2026-10-18, roughly 3.4x the 7-day average of 29 and a 250% increase. This is the largest single-day volume in the current reporting window and marks a sharp departure from the recent baseline. Despite the sample surge, no new C2 servers were registered, suggesting the infrastructure behind this push is already established and reused.
New Samples Detected
The file type breakdown is dominated by ELF-family binaries: .elf (30), .arm (17), .x86 (15), .mips (8), .mpsl (8), .bin (6), .arm7 (3), .arm5 (2), .ppc (2), and .spc (2). The cross-architecture spread is broad, covering ARM (32 total across .arm, .arm5, .arm7), x86 (15), MIPS (8), and PowerPC (2). This is consistent with a coordinated build targeting routers, IoT gateways, and embedded Linux devices across multiple CPU families rather than a single-platform push.
Two entries stand out: .mpsl and .spc. Neither corresponds to a standard executable extension for this malware family, and their presence (8 and 2 samples respectively) may indicate either misnamed or padded samples in the feed or a deliberate naming obfuscation to evade extension-based filtering. Security teams should not whitelist or ignore these extensions when triaging.
7-Day Trend
At 100 samples against a 29 average, today’s volume is well past the 25% deviation threshold that normally warrants a trend flag. Two readings are plausible: a genuine distribution campaign pushing fresh builds, or a bulk submission event (a honeypot catch, a sinkhole, or a scanner pulling a large batch from a single source). The absence of new C2 infrastructure leans toward the latter, or toward reuse of an existing botnet for a fresh wave of infections.
IOC Highlights
All 100 new IOCs are dated to today, with no new C2 servers. This split is worth flagging: IOCs (hashes, filenames, embedded strings) are accumulating without corresponding command-and-control expansion. That pattern is consistent with variant rebuilds of an existing campaign rather than a new one being stood up from scratch.
Security Analysis
The combination of a 250% sample surge, broad multi-architecture coverage, and zero new C2 servers matches the signature of a rebuild-and-repush cycle rather than a new campaign. In prior Mirai waves, this pattern has preceded exploitation of a specific newly disclosed router or IoT vulnerability, with operators recompiling the same loader across architectures to catch newly vulnerable devices while keeping existing C2 infrastructure. The broad ARM, MIPS, and PPC coverage reinforces that the target set is embedded Linux devices, not general-purpose endpoints.
Actionable recommendation: prioritize perimeter egress monitoring for the 100 new IOCs and watch for outbound connection attempts from embedded devices, even though no new C2 addresses appeared today. Because the infrastructure is reused, existing blocklists may already cover it, so the higher-value move is flagging any internal host that begins beaconing to known Mirai C2 ranges. In parallel, review IoT and router firmware exposure for default-credential and known-RCE issues, since a cross-architecture rebuild wave typically signals imminent mass scanning. Treat .mpsl and .spc samples as suspicious until classified, and do not exempt unfamiliar extensions from sandboxing.