Daily Summary
Mirai activity more than doubled today, with 100 new samples collected against a 7-day average of 43 (133% above baseline). The surge is driven almost entirely by ELF binaries (48 samples), which is consistent with an active multi-architecture buildout rather than a single targeted event. No new C2 infrastructure was identified.
New Samples Detected
The architecture spread in today’s set is unusually broad for a single day: .elf (48), .mips (5), .m68k (4), .arm6 (3), .arm5 (3), .armv7l (2), .arm4 (2), and .i686 (2), plus 6 .sh loaders and 2 .mpsl files. The presence of the legacy MIPS and m68k builds alongside modern ARM variants suggests the operator is maintaining a wide IoT router and embedded device target set, not narrowing to a specific vendor. The .sh count (6) indicates the dropping scripts that typically fetch and execute the architecture-matched ELF payloads.
7-Day Trend
Today’s 100 samples is well above the 25% deviation threshold. Compared to the recent baseline of 43, this is the largest single-day volume in the current window. Given the absence of new C2 registrations, the spike looks more like a distribution-side event (increased scanning/exploitation or a broader infection sweep picking up varied firmware) than the seeding of new infrastructure.
IOC Highlights
All 100 new samples produced IOCs, but with zero new C2 servers, the IOCs likely consist of payload hashes, loader URLs, and possibly reused or embedded command servers already tracked. SOC teams should prioritize matching these 100 file hashes against current detections and hunt for the .sh loader patterns across edge devices.
Security Analysis
The wide architecture matrix (m68k, MIPS, and five ARM variants) combined with no new C2 growth matches the pattern of a botnet refilling its ranks across heterogeneous IoT fleets rather than deploying a new command layer. This is consistent with established Mirai campaign behavior where operators cycle payloads to maximize vulnerable device coverage without standing up fresh infrastructure. Actionable recommendation: block and alert on inbound scanning against telnet (23) and common router exploit ports, and fingerprint edge devices by CPU architecture to spot the .m68k and .mpsl payloads, which rarely appear in legitimate firmware and are a strong Mirai indicator.