From Mirai to Modern Botnets: Evolution of Telnet Brute-Forcing and IoT Exploit Delivery

Introduction

The 2016 Mirai botnet was a watershed moment in internet security. By automating the scanning of commodity internet-connected cameras, DVRs, and home routers, Mirai marshaled hundreds of thousands of concurrent devices to launch volumetric DDoS attacks exceeding 1 Tbps.

While the original Mirai relied on a rudimentary dictionary of 62 hardcoded Telnet credentials, modern derivatives (Mozi, Gafgyt, Dark.IoT) have evolved into modular exploit frameworks.

textCopy
Phase 1 (Original Mirai - 2016):
  TCP SYN Scanner ──> Ports 23 / 2323 ──> Telnet Dictionary Brute Force ──> Echo Dropper ──> Bot Active

Phase 2 (Modern IoT Malware - Present):
  SYN Scanner ──> Ports 80 / 443 / 8080 ──> Multi-CVE Remote Code Execution (RCE)
                                                 │
                                                 ├── Realtek SDK RCE (CVE-2021-35395)
                                                 ├── D-Link HNAP / Unauthenticated CGI
                                                 └── TP-Link Command Injection

1. Anatomical Dissection of the Scanner Routine

Original Mirai binaries achieved staggering scan rates through raw socket implementation:

• Scanning routines generate pseudo-random IPv4 destination addresses while excluding reserved ranges (military, government, IANA loopbacks).
• Rather than initiating full TCP three-way handshakes, custom SYN packets are emitted asynchronously.
• When an ACK/SYN is received on port 23, the bot passes the target socket descriptor to the worker login thread.

cCopy
// Simplified excerpt of traditional SYN scan loop
uint32_t get_random_ip(void) {
    uint32_t ip;
    do {
        ip = rand_next();
    } while (
        (ip & 0xFF) == 127 ||           // 127.0.0.0/8 (Loopback)
        (ip & 0xFF) == 10  ||           // 10.0.0.0/8 (RFC 1918)
        (ip & 0xFF) == 0                // 0.0.0.0/8
    );
    return ip;
}

2. Shift to Weaponized 1-Day Exploitation

As consumer ISPs and hardware manufacturers closed default Telnet access, botnet authors pivoted toward unauthenticated HTTP/CGI remote code execution vulnerabilities in embedded router firmware.

Key exploit vectors include:

1. Command Injection in Web Interfaces: Routers frequently concatenate HTTP POST parameters directly into shell commands without sanitization.
2. UPnP SOAP Exploits: Abusing unauthenticated SOAP endpoints on WAN interfaces.
3. Memory Corruption in Legacy Daemons: Exploiting stack buffer overflows in obsolete busybox binaries.

3. Defense & Telemetry Extraction

For threat intelligence researchers, monitoring IoT botnet infrastructure requires:

• Distributed Honeypots: Running medium-interaction Cowrie and Dionaea daemons to capture binary drops and payload URLs.
• Binary Architecture Analysis: Using radare2 and Ghidra to inspect cross-compiled ELF binaries (ARM, MIPS, SuperH, PowerPC) and extract hardcoded C2 IP addresses.