No single piece of malware shaped modern DDoS more than Mirai. It proved that an army of cheap smart devices could break the internet's biggest names - and its leaked code still powers attacks on game servers today. Here is the story, the technical reality, and why the Mirai botnet is still relevant years later.
Quick answer
Mirai is malware that infects IoT devices such as routers, IP cameras and DVRs by logging in with default passwords, turning them into a DDoS botnet. In 2016 it knocked DNS provider Dyn offline, taking major websites down with it. Its source code later leaked, and Mirai variants still attack game servers today.
What is Mirai?
Mirai is a strain of malware that infects IoT devices - routers, IP cameras, DVRs - and conscripts them into a botnet for launching DDoS attacks. It first appeared in 2016 and almost immediately set records, including attacks that knocked major websites and services offline across whole regions.
Its name (Japanese for "future") became shorthand for a new era: DDoS powered not by hacked PCs, but by the billions of insecure gadgets people plug in and forget.
How Mirai works
Mirai's genius was its simplicity. It does not exploit sophisticated vulnerabilities - it just walks through a built-in list of around 60 default username and password combinations that ship on cheap devices. The cycle is brutally effective:
- Scan - each bot continuously probes random IPs for open Telnet/SSH ports.
- Brute-force - it tries the default-credential list until one logs in.
- Infect - it loads itself into memory and reports to command-and-control.
- Spread & attack - the new bot starts scanning for others and awaits attack orders.
Because it lives mostly in memory, a simple reboot often "cleans" a device - right before it gets reinfected minutes later.
The attack that made Mirai famous
In October 2016, Mirai was used to attack Dyn, a major DNS provider that a huge share of the internet depended on. The collateral damage took down Twitter, Reddit, Spotify, Netflix and more for users across the US and Europe - not because those companies were attacked directly, but because the DNS infrastructure underneath them was flooded. It remains one of the clearest demonstrations of how a single well-aimed botnet attack can ripple across the whole internet, and it is covered in more depth in our roundup of the biggest DDoS attacks in history.
Why Mirai was a turning point
Mirai mattered for three reasons that still define DDoS today:
- Scale from nothing - it showed that hundreds of thousands of weak devices beat a handful of strong ones.
- The source code leaked - in late 2016 the author published it publicly, putting a working botnet kit in everyone's hands.
- It became a template - nearly every major IoT botnet since is a Mirai descendant or borrows its techniques.
Mirai did not just break records - it open-sourced the blueprint. Every botnet author since has been standing on its shoulders.
Mirai's descendants - including AISURU
After the leak, dozens of variants appeared, each adding new exploits, new device support and bigger attack methods. The modern terabit-scale botnets - including AISURU - trace their DNA straight back to Mirai's playbook. The result is that today's attacks are far larger than the 2016 originals, yet built on the same core idea.
Why it still threatens game servers
Mirai-style botnets are cheap to rent and devastating to point at a single IP, most often via booter and stresser services built on their infrastructure. Game and voice servers are favourite targets because downtime is instantly visible. The traffic arrives from tens of thousands of ordinary home devices worldwide, so there is no single source to ban - see how to tell if you are being attacked.
What running IoT malware actually does to a victim device
From the device owner's side, a Mirai infection is often invisible - the router still routes, the camera still records - while in the background it eats a slice of upload bandwidth and CPU scanning for new victims and joining attacks. That quiet double life is exactly why so many devices stay infected for years: nothing about daily use tips the owner off, which is also why hardening your own network (not just your server) is worth doing.
How to defend against it
Two fronts. First, keep your own devices out of these botnets: change default passwords and patch firmware. Second - and this is what protects your server - host behind a network that can absorb the flood. A Mirai-class attack has to be filtered upstream, before it reaches your machine, with capacity measured in terabits. That is precisely the design of our protection stack.