Trusted Design

A new IoT Botnet is Spreading over HTTP 81 on a Large Scale

概要

360 Network Security Research Lab recently discovered a new botnet that is scanning the entire Internet on a large scale. Very active, we can now see ~ 50k live scanner IPs daily. Malicious code identified, simple UDP DDoS attacks recorded. Most security vendors fail to identify the malicious code (7/55 on virustotal) This botnet borrows partial code such as port scanning module from the Mirai, but it is completely different from mirai in terms of infect chain, C2 communication protocol, attack module and so on. Although the binary names have mirai mentioned it is probably not wise to treat it just as a mirai variant

Created: 2026-02-23

Indicators

類似Pulses

Mirai Botnet Controller (and/or infected device) IPs (score: 0.73)
Mirai Botnet Infrastructure (score: 0.72)
Mirai IoT botnet (score: 0.70)
Satori:Mirai-like malware botnet infected via Port 37215 and 52869 (score: 0.70)
Mirai Botnet Indicators (score: 0.69)

このPulseに関連する脅威アクター (事実ベース)

APT41

Score: 11.16

Matched TTPs:

T1069 - Permission Groups Discovery
T1036.004 - Masquerade Task or Service
T1003.003 - NTDS
T1008 - Fallback Channels

MITREへのリンク →

Scattered Spider

Score: 5.63

Matched TTPs:

T1069 - Permission Groups Discovery
T1003.003 - NTDS

MITREへのリンク →

TA505

Score: 8.19

Matched TTPs:

T1069 - Permission Groups Discovery
T1608.001 - Upload Malware
T1055.001 - Dynamic-link Library Injection

MITREへのリンク →

Volt Typhoon

Score: 11.84

Matched TTPs:

T1069 - Permission Groups Discovery
T1584.005 - Botnet
T1003.003 - NTDS
T1124 - System Time Discovery

MITREへのリンク →

APT3

Score: 6.91

Matched TTPs:

T1069 - Permission Groups Discovery
T1036.010 - Masquerade Account Name

MITREへのリンク →

FIN13

Score: 7.72

Matched TTPs:

T1069 - Permission Groups Discovery
T1036.004 - Masquerade Task or Service
T1003.003 - NTDS

MITREへのリンク →

HAFNIUM

Score: 9.81

Matched TTPs:

T1583.005 - Botnet
T1584.005 - Botnet
T1003.003 - NTDS

MITREへのリンク →

APT5

Score: 3.84

Matched TTPs:

T1583.005 - Botnet

MITREへのリンク →

Ke3chang

Score: 6.19

Matched TTPs:

T1583.005 - Botnet
T1003.003 - NTDS

MITREへのリンク →

Sandworm Team

Score: 16.32

Matched TTPs:

T1608.001 - Upload Malware
T1195 - Supply Chain Compromise
T1584.005 - Botnet
T1499 - Endpoint Denial of Service
T1003.003 - NTDS

MITREへのリンク →

Mustang Panda

Score: 7.06

Matched TTPs:

T1608.001 - Upload Malware
T1003.003 - NTDS
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Kimsuky

Score: 4.07

Matched TTPs:

T1608.001 - Upload Malware
T1036.004 - Masquerade Task or Service

MITREへのリンク →

Mustard Tempest

Score: 6.51

Matched TTPs:

T1608.001 - Upload Malware
T1608.006 - SEO Poisoning

MITREへのリンク →

OilRig

Score: 12.00

Matched TTPs:

T1608.001 - Upload Malware
T1195 - Supply Chain Compromise
T1008 - Fallback Channels
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

TeamTNT

Score: 6.11

Matched TTPs:

T1608.001 - Upload Malware
T1595.001 - Scanning IP Blocks

MITREへのリンク →

BITTER

Score: 4.07

Matched TTPs:

T1608.001 - Upload Malware
T1036.004 - Masquerade Task or Service

MITREへのリンク →

APT32

Score: 6.81

Matched TTPs:

T1608.001 - Upload Malware
T1036.004 - Masquerade Task or Service
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Contagious Interview

Score: 8.85

Matched TTPs:

T1608.001 - Upload Malware
T1681 - Search Threat Vendor Data
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

FIN7

Score: 10.10

Matched TTPs:

T1608.001 - Upload Malware
T1036.004 - Masquerade Task or Service
T1008 - Fallback Channels
T1124 - System Time Discovery

MITREへのリンク →

Ember Bear

Score: 7.98

Matched TTPs:

T1195 - Supply Chain Compromise
T1595.001 - Scanning IP Blocks

MITREへのリンク →

MoustachedBouncer

Score: 4.54

Matched TTPs:

T1659 - Content Injection

MITREへのリンク →

UNC3886

Score: 12.26

Matched TTPs:

T1681 - Search Threat Vendor Data
T1036.004 - Masquerade Task or Service
T1008 - Fallback Channels
T1124 - System Time Discovery

MITREへのリンク →

Wizard Spider

Score: 10.11

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1003.003 - NTDS
T1055.001 - Dynamic-link Library Injection
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

FIN6

Score: 7.18

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1003.003 - NTDS
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

Fox Kitten

Score: 4.44

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1003.003 - NTDS

MITREへのリンク →

ZIRCONIUM

Score: 4.69

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1124 - System Time Discovery

MITREへのリンク →

Magic Hound

Score: 5.72

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1036.010 - Masquerade Account Name

MITREへのリンク →

Higaisa

Score: 4.69

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1124 - System Time Discovery

MITREへのリンク →

Lazarus Group

Score: 13.80

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1008 - Fallback Channels
T1124 - System Time Discovery
T1055.001 - Dynamic-link Library Injection
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

MITREへのリンク →

BackdoorDiplomacy

Score: 5.02

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1055.001 - Dynamic-link Library Injection

MITREへのリンク →

Axiom

Score: 3.62

Matched TTPs:

T1584.005 - Botnet

MITREへのリンク →

APT29

Score: 4.54

Matched TTPs:

T1090.004 - Domain Fronting

MITREへのリンク →

Storm-1811

Score: 3.62

Matched TTPs:

T1036.010 - Masquerade Account Name

MITREへのリンク →

Dragonfly

Score: 5.96

Matched TTPs:

T1036.010 - Masquerade Account Name
T1003.003 - NTDS

MITREへのリンク →

APT28

Score: 15.55

Matched TTPs:

T1498 - Network Denial of Service
T1003.003 - NTDS
T1669 - Wi-Fi Networks
T1211 - Exploitation for Defense Evasion

MITREへのリンク →

Equation

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Strider

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Chimera

Score: 4.93

Matched TTPs:

T1003.003 - NTDS
T1124 - System Time Discovery

MITREへのリンク →

Medusa Group

Score: 6.88

Matched TTPs:

T1003.003 - NTDS
T1218.014 - MMC

MITREへのリンク →

Turla

Score: 5.52

Matched TTPs:

T1124 - System Time Discovery
T1055.001 - Dynamic-link Library Injection

MITREへのリンク →

Velvet Ant

Score: 4.13

Matched TTPs:

T1211 - Exploitation for Defense Evasion

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Sandworm Team

Score: 0.81

Matched TTPs:

T1499 - Endpoint Denial of Service
T1608.001 - Upload Malware
T1003.003 - NTDS
T1584.005 - Botnet
T1195 - Supply Chain Compromise

MITREへのリンク →

APT28

Score: 0.77

Matched TTPs:

T1211 - Exploitation for Defense Evasion
T1498 - Network Denial of Service
T1003.003 - NTDS
T1669 - Wi-Fi Networks

MITREへのリンク →

Lazarus Group

Score: 0.67

Matched TTPs:

T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1036.004 - Masquerade Task or Service
T1008 - Fallback Channels
T1124 - System Time Discovery
T1055.001 - Dynamic-link Library Injection

MITREへのリンク →

UNC3886

Score: 0.65

Matched TTPs:

T1681 - Search Threat Vendor Data
T1124 - System Time Discovery
T1008 - Fallback Channels
T1036.004 - Masquerade Task or Service

MITREへのリンク →

Volt Typhoon

Score: 0.60

Matched TTPs:

T1124 - System Time Discovery
T1003.003 - NTDS
T1069 - Permission Groups Discovery
T1584.005 - Botnet

MITREへのリンク →

APT41

Score: 0.60

Matched TTPs:

T1008 - Fallback Channels
T1036.004 - Masquerade Task or Service
T1003.003 - NTDS
T1069 - Permission Groups Discovery

MITREへのリンク →

OilRig

Score: 0.58

Matched TTPs:

T1608.001 - Upload Malware
T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
T1008 - Fallback Channels
T1195 - Supply Chain Compromise

MITREへのリンク →

FIN7

Score: 0.55

Matched TTPs:

T1608.001 - Upload Malware
T1124 - System Time Discovery
T1008 - Fallback Channels
T1036.004 - Masquerade Task or Service

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る