Mirai botnet surges target IoT devices in Japan
JPCERT observed Mirai botnet activity targeting IoT devices in Japan, with notable spikes in May 2024, September-December 2024, and February-March 2025.
JPCERT/CC's TSUBAME sensor network detected significant Mirai malware scanning activity during fiscal year 2024, particularly targeting port 23/TCP. Three distinct waves occurred: May 2024 targeted routers from vendors like TP-Link, September-December 2024 focused on security cameras, DVRs, and NAS devices from overseas vendors, and February-March 2025 targeted routers from vendors including ASUS. During peak periods, packets with Mirai characteristics comprised over 50% of total traffic observed.
The threat actors conducted reconnaissance to identify Internet-accessible ports and known vulnerabilities in target products before launching attacks. JPCERT also observed reflected packets from corporate web servers indicative of DDoS attacks and shared this intelligence with affected organizations through CSIRT channels. Analysis revealed that overseas sensors consistently received higher packet volumes than Japanese sensors, with both locations experiencing traffic increases in March 2025.
JPCERT recommends organizations maintain current firmware, implement proper security configurations, conduct regular port scans, and leverage tools like SHODAN to verify exposure. The organization continues coordinating with domestic product developers and ISPs to mitigate Mirai infections and botnet expansion.
Mentioned in this report
Detection guidance
Mirai-Style Mass Telnet (Port 23) Scanning Sweep
Detects a single source host attempting connections to TCP/23 against a large number of distinct destination hosts, consistent with Mirai-style IP block scanning for exposed Telnet services; expect the volume threshold (e.g. >50 distinct destinations in a short window) to be enforced by the SIEM correlation layer, not this rule alone. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mirai-Style Mass Telnet (Port 23) Scanning Sweep
id: d6435f27-c263-577d-aa15-2b6fa475f799
status: experimental
description: Detects connections to TCP/23 (Telnet) from a single source toward many
distinct destination hosts, consistent with Mirai botnet reconnaissance sweeps scanning
IP blocks for exposed Telnet/IoT management interfaces. Correlate with a distinct-destination-count
threshold (e.g. >50 unique destination IPs within 10 minutes from one source) in
the SIEM to reduce noise.
references:
- JPCERT/CC TSUBAME sensor network FY2024 Mirai reporting
author: Vorant
logsource:
category: network_connection
product: linux
detection:
selection:
DestinationPort: 23
Initiated: 'true'
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate network monitoring or asset discovery tools scanning internal Telnet-enabled
devices
- Internal IT teams auditing legacy equipment that still exposes Telnet
level: medium
tags:
- attack.reconnaissance
- attack.t1595.001
Mirai Telnet Default Credential Brute Force Attempt
Detects repeated authentication attempts against exposed Telnet (port 23) services from a single external source, indicative of Mirai-style default/weak credential brute forcing against IoT devices such as routers, cameras, DVRs, and NAS boxes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mirai Telnet Default Credential Brute Force Attempt
id: 78a3882b-0f34-5e44-b82b-43065eafaf4d
status: experimental
description: Detects repeated failed or rapid successive authentication attempts on
TCP/23 (Telnet) from the same source IP against one or more IoT devices, consistent
with Mirai botnet credential stuffing using built-in default credential lists. Threshold
guidance is a high count of auth attempts (e.g. >10) from one source within a few
minutes, enforced at the correlation layer.
references:
- JPCERT/CC TSUBAME sensor network FY2024 Mirai reporting
author: Vorant
logsource:
category: authentication
product: linux
service: telnet
detection:
selection:
DestinationPort: 23
Status: failure
condition: selection
falsepositives:
- Operations staff mistyping credentials while managing legacy Telnet-enabled network
equipment
- Automated configuration management scripts retrying Telnet logins after credential
rotation
level: medium
tags:
- attack.credential_access
- attack.t1110
Anomalous High-Volume Reflected Traffic from Corporate Web Server (Possible DDoS Reflection)
Detects a corporate web server sending an abnormally high volume of unsolicited response-like traffic to numerous distinct external destinations on standard web ports, consistent with the host being abused as a reflector/amplifier in a Mirai-driven DDoS campaign as reported by JPCERT/CC. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Anomalous High-Volume Reflected Traffic from Corporate Web Server (Possible
DDoS Reflection)
id: 3102d2d7-2e43-5935-b088-b8cbf2a1d97c
status: experimental
description: Detects a web/application server sending a high volume of outbound traffic
on standard web ports (80/443) toward a large number of distinct external destination
hosts without corresponding matched inbound client sessions, consistent with the
server being abused as a DDoS reflector as described in JPCERT/CC Mirai reporting.
Volume/fan-out thresholds should be enforced by the SIEM correlation layer.
references:
- JPCERT/CC TSUBAME sensor network FY2024 Mirai reporting
author: Vorant
logsource:
category: network_connection
product: linux
detection:
selection:
SourcePort:
- 80
- 443
Initiated: 'true'
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- CDN or load balancer infrastructure legitimately fanning out responses to many client
IPs
- Web server performing bulk outbound API calls or webhooks to many external endpoints
level: medium
tags:
- attack.impact
- attack.t1498
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2025/07/tsubame_overflow_2025-01-03.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free