ALT-26 · Paper · 23 Oct 2026
Mirai: the botnet made of default passwords
Cameras and routers with factory passwords became a botnet that knocked major websites offline in 2016. A study of who built it, how it spread, and why its source code outlived it.
- Aug 2016Mirai appears and grows quickly.
- Sep 2016Attacks on the KrebsOnSecurity site and the host OVH; the source code is published on 30 September.
- 21 Oct 2016Attacks on Dyn disrupt access to large websites.
- 2017Three young men plead guilty in the US to creating Mirai.
- Peak infected devices
- 600k+Antonakakis et al., USENIX Security 2017
How it spread
No exploits were needed: a short list of default credentials was enough. Infected devices scanned for more victims and reported them to a loader, which installed the bot. Rebooting removed it — until the next scan reinfected the device minutes later.
Why it mattered
Once the source code was public, variants multiplied. Mirai turned weak defaults into a public safety issue and fed directly into laws that now ban universal default passwords on consumer devices.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Defaults are policy: whatever ships is what most people run.
- A device that cannot be updated is a liability with a long tail.
- DNS providers are concentration points; depending on one is a design choice.
What it means for you
- Ship devices with unique per-device credentials and no open Telnet.
- Keep IoT on its own network segment, without inbound access from the internet.
- Use more than one DNS provider for anything that must stay reachable.
Sources
- Antonakakis et al. — Understanding the Mirai Botnet, USENIX Security 2017
- CISA — Heightened DDoS threat posed by Mirai and other botnets (TA16-288A)
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-26 — Mirai: the botnet made of default passwords. 23 Oct 2026. altumptic.com/research/mirai-2016