Mirai Botnet: the camera malware that took Twitter down in 2016

It was October 21, 2016. Millions of people tried to open Twitter early that morning and got a blank page. Reddit vanished. Netflix wouldn't load. Spotify, Airbnb, PayPal, CNN — all offline. The cause wasn't a software bug or a server failure. It was an army of refrigerators, security cameras and home routers, conscripted without their owners' knowledge, firing requests at a single target.

The malware's name was Mirai — Japanese for future. Ironically, it redefined the future of security for connected devices.

What the Mirai Botnet was

Mirai was malware designed to infect IoT devices (Internet of Things — IP cameras, DVRs, routers, printers, smart TVs) and turn them into zombies in a coordinated network. That network was then rented out or used directly for distributed denial of service (DDoS) attacks, flooding targets with traffic until they collapsed.

What set Mirai apart from earlier botnets wasn't technical sophistication — it was scale. At its peak, Mirai controlled more than 600,000 devices simultaneously. Linksys routers, Dahua surveillance cameras, Hikvision DVRs. Ordinary appliances, bought in physical stores and online, installed by people who would never have imagined their equipment was taking part in the biggest DDoS attack in history.

How Mirai infected devices

The method was brutally simple. Mirai scanned the internet for devices with Telnet ports (23 and 2323) open and tried to authenticate using a list of 62 default credential combinations — things like admin/admin, root/root, admin/1234, support/support.

IoT device manufacturers have a long-standing habit of shipping identical default passwords across an entire product line — and consumers, for the most part, never change them. Mirai exploited exactly that. There was no sophisticated zero-day, no novel vulnerability being exploited. It was pure negligence encoded into a product.

Why are default passwords so dangerous in IoT?

Because IoT devices rarely get any security attention after purchase. A computer has antivirus, automatic updates and a user who (sometimes) pays attention. A cheap security camera stays powered on 24 hours a day, with Telnet open, a default password and outdated firmware — and nobody checks. Mirai spread from one infected device to others on the same network and beyond, forming an autonomous infection chain.

The practical result: within weeks, hundreds of thousands of devices across dozens of countries were under the botnet's control, waiting for orders from a command-and-control (C2) server.

The attacks that preceded Twitter's collapse

Mirai didn't debut straight against Dyn. Before that, its creators tested the system against smaller targets — and larger ones than they realized:

• September 20, 2016: an attack on the site of journalist Brian Krebs (KrebsOnSecurity), a security specialist and one of the field's biggest names. The peak hit 623 Gbps — at the time, the largest DDoS attack ever recorded against an individual site. Akamai, which was providing Krebs with free protection, had to shut the service off in the face of the volume.
• Late September 2016: an attack against OVH, the French hosting provider. Estimated volume of up to 1 Tbps — breaking the record again.

Shortly after the OVH attacks, on September 30, 2016, a user going by "Anna-senpai" on the Hackforums board published Mirai's complete source code. The decision was, at minimum, irresponsible — and probably strategic, meant to make identifying the creators harder. With the code public, anyone could build their own variants, and responsibility would be diluted.

October 21, 2016: the fall of Dyn

Dyn was one of the world's largest DNS (Domain Name System) providers. DNS is, put simply, the internet's "phone book": when you type twitter.com, DNS translates that name into the server's actual IP address. With DNS down, sites are unreachable — even if they're up.

Mirai's creators pointed the botnet at Dyn's servers in two attacks that day. At the peak, traffic reached 1.2 terabits per second. Dyn's infrastructure collapsed, and with it every service that depended on that DNS:

• Twitter, Reddit, Netflix, Spotify
• Airbnb, PayPal, Slack
• Amazon, GitHub, CNN
• Dozens of other global services

For the US east coast, the internet looked broken. Technically, it was — for anything that depended on Dyn to resolve a domain name.

The creators and the legal outcome

The FBI investigated the case for more than a year. On December 8, 2017, three young men pleaded guilty to the attacks:

• Paras Jha, 21, a Computer Science student at Rutgers University — the code's primary author.
• Josiah White, 20, co-creator and infrastructure developer.
• Dalton Norman, 21, responsible for exploits and operations.

The sentence came as a surprise: none of the three went to prison. They received five years of probation, 2,500 hours of community service and were ordered to pay restitution — plus continue cooperating with the FBI on cybercrime investigations. Their extensive cooperation with authorities was decisive in the lenient sentence. The three ended up working side by side with federal agents to dismantle other botnets.

According to Krebs on Security, which covered the case in depth, the creators also ran ProTraf Solutions, a front company selling "DDoS protection" — in other words, they created the attacks and then offered the antidote.

What Mirai changed in IoT security

Mirai's legacy goes beyond the incident itself. The open source code spawned hundreds of variants — Satori, Okiru, Masuta, JenX — each adapted to different vulnerabilities and device families. Ten years on, botnets derived from Mirai still circulate across the internet, infecting routers and cameras with the same basic trick from 2016.

On the regulatory side, the attack forced a conversation the industry had been resisting: in several countries, manufacturers can no longer sell IoT devices with generic default passwords. The UK passed the Product Security and Telecommunications Infrastructure Act in 2024, which bans universal default passwords in connected products. The EU is moving in the same direction with the Cyber Resilience Act.

In many other markets — Brazil included — regulation is still in its infancy, and the appetite for cheap IP cameras (plenty of them running unsupported firmware with Telnet open) keeps the risk very much alive. Knowing how to configure a home router properly is the first step to not joining a botnet without noticing.

What makes an IoT device vulnerable in the Mirai style?

Unchanged default credentials, an exposed Telnet port and outdated firmware. Those are three independent conditions — any one of them is already a risk, and all three together are an open invitation. Most botnet attacks don't require sophisticated exploitation: you just have to find the device and try the most common passwords.

How to protect yourself (what you can do right now)

• Change the default password on every connected device — router, IP camera, smart TV, DVR. Use a unique, strong password for each one.
• Disable Telnet and UPnP on the router. Those protocols are rarely necessary for home use and widen the attack surface.
• Keep firmware updated. Yes, security cameras have firmware. Check the manufacturer's dashboard periodically.
• Separate IoT from the main network. Most modern routers support VLANs or a guest network — put cameras and smart TVs there, isolated from computers and phones.
• Discard unsupported equipment. A camera with 2015 firmware from a manufacturer that's left the market? That's an active risk, not a functioning asset.

Mirai exposed something a lot of people still ignore: security doesn't end at the computer. Every device connected to the internet is a potential way in — and, if compromised, a potential weapon pointed at someone else.

To understand another case where malware compromised global infrastructure through patching negligence, it's worth reading about WannaCry, the NSA ransomware that paralyzed hospitals in 2017. And if the subject of silent bugs that sit in production for years interests you, Heartbleed in 2014 is required reading.

The biggest botnet in history was built out of cameras bought off the shelf and passwords printed in the manufacturer's manual. If that isn't an argument for taking IoT security seriously, I don't know what is.