What Is the Mirai Botnet? The Malware That Rewrote DDoS

No single piece of malware shaped modern DDoS more than Mirai. It proved that an army of cheap smart devices could break the internet's biggest names — and its leaked code still powers attacks on game servers today. Here is the story and the technical reality.

What is Mirai?

Mirai is a strain of malware that infects IoT devices — routers, IP cameras, DVRs — and conscripts them into a botnet for launching DDoS attacks. It first appeared in 2016 and almost immediately set records, including attacks that knocked major websites and services offline across whole regions.

Its name (Japanese for "future") became shorthand for a new era: DDoS powered not by hacked PCs, but by the billions of insecure gadgets people plug in and forget.

How Mirai works

Mirai's genius was its simplicity. It does not exploit sophisticated vulnerabilities — it just walks through a built-in list of around 60 default username and password combinations that ship on cheap devices. The cycle is brutally effective:

• Scan — each bot continuously probes random IPs for open Telnet/SSH ports.
• Brute-force — it tries the default-credential list until one logs in.
• Infect — it loads itself into memory and reports to command-and-control.
• Spread & attack — the new bot starts scanning for others and awaits attack orders.

Because it lives mostly in memory, a simple reboot often "cleans" a device — right before it gets reinfected minutes later.

Why Mirai was a turning point

Mirai mattered for three reasons that still define DDoS today:

• Scale from nothing — it showed that hundreds of thousands of weak devices beat a handful of strong ones.
• The source code leaked — in late 2016 the author published it publicly, putting a working botnet kit in everyone's hands.
• It became a template — nearly every major IoT botnet since is a Mirai descendant or borrows its techniques.

Mirai did not just break records — it open-sourced the blueprint. Every botnet author since has been standing on its shoulders.

Mirai's descendants — including AISURU

After the leak, dozens of variants appeared, each adding new exploits, new device support and bigger attack methods. The modern terabit-scale botnets — including AISURU — trace their DNA straight back to Mirai's playbook. The result is that today's attacks are far larger than the 2016 originals, yet built on the same core idea.

Why it still threatens game servers

Mirai-style botnets are cheap to rent and devastating to point at a single IP. Game and voice servers are favourite targets because downtime is instantly visible. The traffic arrives from tens of thousands of ordinary home devices worldwide, so there is no single source to ban — see how to tell if you are being attacked.

How to defend against it

Two fronts. First, keep your own devices out of these botnets: change default passwords and patch firmware. Second — and this is what protects your server — host behind a network that can absorb the flood. A Mirai-class attack has to be filtered upstream, before it reaches your machine, with capacity measured in terabits. That is precisely the design of our protection stack.