Mirai botnet surges target IoT devices in Japan
JPCERT observed Mirai botnet activity targeting IoT devices in Japan, with notable spikes in May 2024, September-December 2024, and February-March 2025.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
JPCERT/CC's TSUBAME sensor network detected significant Mirai malware scanning activity during fiscal year 2024, particularly targeting port 23/TCP. Three distinct waves occurred: May 2024 targeted routers from vendors like TP-Link, September-December 2024 focused on security cameras, DVRs, and NAS devices from overseas vendors, and February-March 2025 targeted routers from vendors including ASUS. During peak periods, packets with Mirai characteristics comprised over 50% of total traffic observed.
The threat actors conducted reconnaissance to identify Internet-accessible ports and known vulnerabilities in target products before launching attacks. JPCERT also observed reflected packets from corporate web servers indicative of DDoS attacks and shared this intelligence with affected organizations through CSIRT channels. Analysis revealed that overseas sensors consistently received higher packet volumes than Japanese sensors, with both locations experiencing traffic increases in March 2025.
JPCERT recommends organizations maintain current firmware, implement proper security configurations, conduct regular port scans, and leverage tools like SHODAN to verify exposure. The organization continues coordinating with domestic product developers and ISPs to mitigate Mirai infections and botnet expansion.
Mentioned in this report
Detection guidance
Mirai-Style Mass Telnet (Port 23) Scanning Sweep
A behavioural hunt for the technique in general.
Detects a single source host attempting connections to TCP/23 against a large number of distinct destination hosts, consistent with Mirai-style IP block scanning for exposed Telnet services; expect the volume threshold (e.g. >50 distinct destinations in a short window) to be enforced by the SIEM correlation layer, not this rule alone. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mirai-Style Mass Telnet (Port 23) Scanning Sweep
id: d6435f27-c263-577d-aa15-2b6fa475f799
status: experimental
description: Detects connections to TCP/23 (Telnet) from a single source toward many
distinct destination hosts, consistent with Mirai botnet reconnaissance sweeps scanning
IP blocks for exposed Telnet/IoT management interfaces. Correlate with a distinct-destination-count
threshold (e.g. >50 unique destination IPs within 10 minutes from one source) in
the SIEM to reduce noise.
references:
- JPCERT/CC TSUBAME sensor network FY2024 Mirai reporting
author: Vorant
logsource:
category: network_connection
product: linux
detection:
selection:
DestinationPort: 23
Initiated: 'true'
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate network monitoring or asset discovery tools scanning internal Telnet-enabled
devices
- Internal IT teams auditing legacy equipment that still exposes Telnet
level: medium
tags:
- attack.reconnaissance
- attack.t1595.001
Anomalous High-Volume Reflected Traffic from Corporate Web Server (Possible DDoS Reflection)
A behavioural hunt for the technique in general.
Detects a corporate web server sending an abnormally high volume of unsolicited response-like traffic to numerous distinct external destinations on standard web ports, consistent with the host being abused as a reflector/amplifier in a Mirai-driven DDoS campaign as reported by JPCERT/CC. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Anomalous High-Volume Reflected Traffic from Corporate Web Server (Possible
DDoS Reflection)
id: 3102d2d7-2e43-5935-b088-b8cbf2a1d97c
status: experimental
description: Detects a web/application server sending a high volume of outbound traffic
on standard web ports (80/443) toward a large number of distinct external destination
hosts without corresponding matched inbound client sessions, consistent with the
server being abused as a DDoS reflector as described in JPCERT/CC Mirai reporting.
Volume/fan-out thresholds should be enforced by the SIEM correlation layer.
references:
- JPCERT/CC TSUBAME sensor network FY2024 Mirai reporting
author: Vorant
logsource:
category: network_connection
product: linux
detection:
selection:
SourcePort:
- 80
- 443
Initiated: 'true'
filter:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- CDN or load balancer infrastructure legitimately fanning out responses to many client
IPs
- Web server performing bulk outbound API calls or webhooks to many external endpoints
level: medium
tags:
- attack.impact
- attack.t1498
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2025/07/tsubame_overflow_2025-01-03.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs