Attacks/Mirai Botnet
HIGH SEVERITY

Mirai Botnet

2016
ddos

IoT botnet launched 1.2 Tbps DDoS, taking down Twitter, Netflix.

technologyinfrastructure
Simulate Attack

!What Happened

Infected 600K+ IoT devices with default credentials. Attacked Dyn DNS.

⚡Vulnerability Exploited

Default IoT credentials

→Attack Flow

1
recon

IoT Scanning

Finding devices with Telnet

[SCAN] 600K+ devices found
2
exploitation

Default Login

admin/admin credentials

[AUTH] root:root success
3
installation

Bot Deployment

Installing Mirai

[BOT] Joined botnet
4
actions

DDoS Attack

1.2 Tbps flood

[DDOS] 1.2 Tbps attack

💥Impact

Major sites offline for hours.

Records Compromised
0
Financial Cost
$110+ million (estimated)

🔧Technical Details

Target System
Dyn DNS
server
DNS
Attacker Profile
Botnet Controller
server • Linux
Vulnerability / CVE
Default IoT credentials

📅Attack Timeline

Initial Attack
2016
Attack initiated and vulnerability exploited
Discovery & Impact
Shortly after 2016
Major sites offline for hours.
Response & Mitigation
Remediation Phase
BGP flowspec. Firmware updates.

🎯Is This Attack Still Relevant Today?

DDoS attacks have evolved significantly since Mirai Botnet. Modern botnets are larger, and amplification techniques have become more sophisticated. However, DDoS mitigation services and content delivery networks now provide better protection.

⚠️ Still Active Threat

💡Key Takeaways

  • •Change default passwords.
  • •Defense in depth with multiple security layers is essential
  • •Key defense: Change Default Credentials - Prevents brute-force credential attacks

Defense Applied

BGP flowspec. Firmware updates.

Lessons Learned

Change default passwords.

Attacker Tools

Mirai
IoT botnet

Defense Options

Change Default Credentials
Replace factory default admin:admin passwords on all IoT devices
Disable Telnet Protocol
Disable insecure Telnet and use SSH instead
IoT Firmware Update
Apply manufacturer security patches to IoT devices
Upstream Rate Limiting
ISP-level traffic rate limiting and filtering
Legacy IoT (No Updates)
Older devices with no firmware update capability

MITRE ATT&CK

Tactics
Initial AccessImpact
Techniques
T1078T1498