In October 2016 a botnet called Mirai took down Dyn, a major DNS provider, and with it Twitter, Netflix, Reddit and dozens of other sites. The attack peaked around 1.2 Tbps — the largest recorded at the time — and the weapon was almost comically mundane: hijacked IP cameras, DVRs and home routers still running the passwords their manufacturers shipped them with. Mirai is worth studying not as history but because everything attacking the internet today is built on its ideas.
How Mirai Worked
- It scanned the internet continuously for devices with open Telnet ports (23 and 2323).
- It tried 61 hard-coded default username/password pairs — the factory logins for common cameras and routers.
- Compromised devices were enrolled as bots while continuing to work normally, so owners noticed nothing.
- A command-and-control server issued orders: target IP, duration, attack type and packet parameters.
Why the Source Code Release Mattered
In September 2016 Mirai's author published the source code publicly — a decision that turned one botnet into a whole family. Once the code was open, anyone could build on it, and they did: Masuta, Satori, Reaper and many others followed. Modern descendants pair Mirai's scanner with N-day exploits, so they no longer even need default passwords — a device that was given a strong password but never patched is still recruitable.
Open code, permanent problem
Mirai stopped being a single event the day its source went public. The techniques are now baseline knowledge for attackers, which is why Mirai-family traffic is a daily background hum on the internet rather than a headline.
The Threat Today
- The installed base of IoT devices is projected to pass 30 billion, most of it never meaningfully patched.
- Firmware update mechanisms on consumer routers and cameras remain largely non-functional.
- Mirai-variant attacks are a daily occurrence, not a rare event.
- Much of their output is HTTP-flood traffic — exactly the automated request pattern a reverse-proxy challenge and rate limits are built to filter.
Defending Against Mirai-Class Traffic
You cannot fix the world's IoT devices, so the defence is on your side of the wire. For the application-layer portion of a Mirai-family attack — the HTTP floods — a reverse proxy that challenges automated clients, rate-limits by IP and ASN, and hides your origin turns the flood into a stream of failed requests. Akarguard does this at the edge; the raw volumetric component is absorbed upstream at the network. Assume Mirai-family bots are probing your internet-facing services right now — the only question that matters is whether your stack filters their traffic or falls over under it.