Daily Summary
Mirai activity rebounded sharply today with 100 new samples, a 75% increase over the 7-day average of 57. This is the highest single-day count in the recent window and reverses a declining trend seen over the past several days. No new C2 servers were identified, suggesting the surge reflects fresh build activity or recompilation rather than new infrastructure deployment.
New Samples Detected
The file type breakdown reveals a highly heterogeneous build set. ELF binaries dominate at 57, but the long tail is notable: 9 shell scripts, 5 generic .bin payloads, and a wide spread of architecture-specific variants including .ppc (4), .arm5 (3), .mips (3), .x86_64 (2), .arm6 (2), and .aarch64 (2). Two .mpsl samples also appeared, alongside 5 .bin files. This cross-architecture spread spanning PowerPC, ARM, MIPS, x86_64, and aarch64 points to a multi-platform build pipeline rather than a single targeted deployment. The presence of .ppc is somewhat unusual for Mirai, whose recent builds have trended toward ARM and MIPS for IoT routers and DVRs. Shell scripts likely serve as droppers or environment-setup stagers accompanying the compiled binaries.
7-Day Trend
At 75% above the 7-day average, today’s count crosses the threshold for a notable surge. The jump from a baseline in the mid-50s to 100 samples in a single day warrants attention, though the absence of new C2 servers tempers the immediate threat signal. A plausible read is that an operator or builder refreshed their variant portfolio across architectures, producing a burst of samples without yet standing up new command infrastructure.
IOC Highlights
All 100 new IOCs are catalogued and ready for ingestion into blocking controls. With no new C2 domains or IPs, these IOCs are likely hash- and filename-based indicators tied to the binary set. SOC teams should prioritize ELF and architecture-specific hashes for endpoint and network detection.
Security Analysis
The most interesting signal today is the architecture breadth combined with zero new C2. Compared to typical Mirai campaigns, which concentrate builds on ARM and MIPS to hit consumer IoT, this spread across PowerPC and aarch64 resembles a compilation sweep, possibly a builder testing toolchains or restaging an existing botnet’s payload set ahead of a deployment. Attackers often pre-build binaries before attaching them to fresh infrastructure. Actionable recommendation: treat today’s 100 IOCs as a leading indicator and tighten monitoring for outbound connections from embedded and PowerPC-based devices over the next 72 hours, since a C2 rollout may follow this sample surge. Ingest the hashes now rather than waiting for domains.