Mirai Botnets Evolve Into Major DDoS and Proxy Abuse Threats

Mirai-based botnets have evolved from simple IoT malware into highly scalable DDoS and residential-proxy abuse platforms: between July and December 2025 over 21,000 C2 servers were observed and Cloudflare attribution links the Aisuru‑Kimwolf family to a 31.4 Tbps hyper‑volumetric attack. Variants (e.g., Satori, Kimwolf) expand targets and evasion, operators repurpose infected devices as rentable residential proxies, and infrastructure recycling enables quick rebuilds after takedowns. Defenders are advised to prioritize basic edge-device hygiene, monitor unusual outbound traffic, and track Mirai-derived indicators.