Mirai worm exploits cPanel/WHM flaw for spike

18 September 2026 high threat technologyinfrastructure

JPCERT/CC's TSUBAME sensors saw a sharp Mirai-like scan surge on 23/TCP in early May 2026 linked to exploitation of a cPanel/WHM auth-bypass flaw (CVE-2026-41940).

JPCERT/CC's quarterly TSUBAME internet threat monitoring report for April-June 2026 highlights a notable spike in Mirai-like packets targeting port 23/TCP beginning April 30, 2026, peaking in early May before gradually declining. Source IP analysis showed many originating from hosting-provider IP ranges running cPanel administration interfaces, suggesting server (not just IoT device) compromise. Correlating with external reporting from Censys and Japan's NICTER Analysis Team, JPCERT/CC assesses the surge was likely associated with Mirai or variant infection activity exploiting a cPanel/WHM authentication bypass vulnerability (CVE-2026-41940), which allows attackers to bypass authentication and compromise affected hosting servers. The activity was globally distributed, with the United States seeing the largest share and notable increases also in Germany, France, and Canada; Japanese sensor traffic rose roughly 15x above baseline during the peak, indicating broad, non-regionally-concentrated scanning/infection rather than a targeted campaign.

Beyond the Mirai spike, the report notes routine scanning trends: 23/TCP remained the most commonly targeted port across most sensors, with 443/TCP, 80/TCP, 8080/TCP, and 22/TCP also broadly observed, indicating continuous wide-scale internet scanning rather than anomalous activity. JPCERT/CC states no other unusual activity warranted a special alert this quarter.

For defenders, particularly those operating cPanel/WHM-based hosting infrastructure, the key action is to patch against CVE-2026-41940 promptly, restrict remote/administrative access, and enforce strong credentials. Because Mirai variants can now compromise servers in addition to IoT devices, incident responders should review running processes and outbound network connections for signs of botnet activity even on non-IoT infrastructure with cPanel/WHM installed.

Mentioned in this report

Vulnerabilities CVE-2026-41940KEV

Malware Mirai

Detection guidance

Mirai-like Telnet Scanning Activity from Server Processes

ATT&CK T1595.001

Detects outbound connections to port 23/TCP (Telnet) at scale, typical of Mirai botnet scanning behaviour from compromised servers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Mirai-like Telnet Scanning Activity from Server Processes
description: Detects processes establishing outbound connections to port 23/TCP in
  bulk, consistent with Mirai botnet reconnaissance and exploitation scanning. Targets
  servers where cPanel/WHM compromise may have occurred.
tags:
- attack.reconnaissance
- attack.t1595.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 23
    Protocol: tcp
    Direction: outbound
  filter_legitimate_telnet:
    Image|endswith:
    - \ssh.exe
    - \putty.exe
    - \telnet.exe
    User|contains: SYSTEM
  condition: selection and not filter_legitimate_telnet
falsepositives:
- Legitimate telnet administration tools used by sysadmins
- Network monitoring appliances scanning for open telnet
level: high
id: 2553d0b9-9845-5a17-bd60-6df3a1c8a29d
status: experimental
author: Vorant

cPanel/WHM Process Spawning Network Scanning Tools

ATT&CK T1190

Detects cPanel/WHM-related processes launching tools commonly used for reconnaissance (netcat, curl, wget) or spawning shells, indicative of post-exploitation activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: cPanel/WHM Process Spawning Network Scanning Tools
description: Detects cPanel/WHM daemon processes (or their children) spawning reconnaissance
  or shell tools, consistent with post-exploitation behaviour after CVE-2026-41940
  or similar auth-bypass compromise.
tags:
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - cpanel
    - whm
    - cpsrvd
  selection_child:
    Image|endswith:
    - /nc
    - /ncat
    - /curl
    - /wget
    - /sh
    - /bash
  filter_legitimate:
    User: root
    CommandLine|contains:
    - backup
    - update
    - maintenance
  condition: (selection_parent and selection_child) and not filter_legitimate
falsepositives:
- cPanel update or backup processes legitimately invoking curl/wget
- Shell spawned for routine cPanel administrative tasks
level: medium
id: 88d82c23-d6f8-5959-8b33-7f2887a5e921
status: experimental
author: Vorant

Suspicious Outbound Botnet Communication from Compromised Server

ATT&CK T1584.005

Detects outbound connections to known botnet C2 ports or anomalous high-volume scanning from server processes following suspected cPanel compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Outbound Botnet Communication from Compromised Server
description: Detects processes on servers establishing outbound connections to multiple
  distinct IPs on common botnet ports (typically 22, 23, 80, 443, 8080), or to uncommon
  high ports, indicative of Mirai or similar botnet activity post-compromise.
tags:
- attack.command-and-control
- attack.t1584.005
logsource:
  category: network_connection
  product: linux
detection:
  selection_ports:
    DestinationPort:
    - 22
    - 23
    - 80
    - 443
    - 8080
  selection_process:
    Image|endswith:
    - /httpd
    - /nginx
    - /apache2
    - /sshd
    User: root
  selection_outbound:
    Direction: outbound
  filter_expected:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: (selection_process and selection_outbound and selection_ports) and not
    filter_expected
falsepositives:
- Server maintenance connecting to upstream mirrors or repositories
- Load balancers or proxies communicating with backend pools
level: medium
id: 9dc45dc7-3673-5ff4-8e0c-0a96b261c42f
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://blogs.jpcert.or.jp/en/2026/09/tsubame_overflow_2026-04-06.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free