New Mirai Variant Adds Encrypted C2 and Credential Sniffer

Researchers have documented a new Mirai variant that adds two capabilities the original botnet never had: encrypted command-and-control communications, and a built-in sniffer designed to locate devices still running factory-default credentials, The Record reported Thursday.

Mirai’s original 2016 run — the one that briefly knocked out large portions of the internet by flooding Dyn’s DNS infrastructure — was built almost entirely on the failure of device manufacturers and their customers to change default passwords. That playbook worked because the attack surface was enormous and largely invisible. A decade later, the credential sniffer in this new variant is betting the same attack surface still exists. That bet has historically been correct.

The encrypted C2 channel is the part that should concern incident responders more immediately. Traditional detection approaches for Mirai and its derivatives relied heavily on network-layer visibility: catch the plaintext C2 traffic, block known command-and-control IPs, flag unusual outbound connections from device subnets. Encryption breaks the first leg of that chain. You can still observe that a device is making unusual outbound connections; you can no longer easily see what it is saying without TLS inspection at the perimeter — a step most organizations haven’t taken for IoT network segments, if those segments exist at all.

Analysis: Encrypted C2 has been standard in sophisticated malware for years. What’s notable here is the pattern reaching botnet code that operates at IoT scale — targeting cheap embedded devices that typically can’t run endpoint agents, run custom firmware that resists inspection, and sit on networks whose owners haven’t thought about them since installation. The combination of credential-hunting and encrypted persistence means that once a device is compromised, detection and remediation become materially harder than they were with the original Mirai tooling.

For defenders with IoT exposure in their environments:

• Change default credentials. Every network-facing device. This is the decade-old advice that this variant’s credential sniffer is still counting on most sites haven’t followed.
• Segment IoT onto isolated VLANs with restricted egress rules. It won’t prevent infection, but it limits blast radius and makes anomalous outbound connections easier to isolate from business-critical traffic.
• Update firmware wherever vendors provide it — especially on routers, IP cameras, and NAS devices that have historically been primary Mirai targets.
• Reassess network monitoring posture. If detection relies on plaintext traffic pattern matching, encrypted C2 bypasses it. Behavioral anomaly detection and egress volume baselining become more important as botnets encrypt their communications.

The credential angle is worth sitting with. Mirai became notorious for exploiting a weakness that wasn’t fundamentally technical — it was organizational. Nobody changed the passwords because nobody thought about it, and device manufacturers shipped with defaults because there was no incentive not to. The attack surface has grown since 2016, not shrunk: more devices, cheaper devices, more SKUs from manufacturers with no meaningful security requirement baked into the supply chain. This new variant’s credential sniffer is running the same play that worked a decade ago. The fact that it still expects to find devices on default credentials — and that researchers expect it to be right — says more about the state of IoT security than any individual malware capability does.

Related: Android NFC Relay Malware Drains Bank Accounts in Real Time | Tenda Router Backdoor CVE-2026-11405 Remains Unpatched