Mirai Malware Evolves into Hundreds of Variants Driving Botnet Growth

Researchers at Pulsedive and Spamhaus report a significant surge in botnet command-and-control infrastructure—a 24% rise in the latter half of 2025—with the United States becoming a primary hub. The growth is driven mainly by numerous Mirai variants (over 21,000 samples and 116 branches) that target IoT and Android devices, enabling massive DDoS campaigns (reported up to 31.4 Tbps and 14.1 billion pps). Operators use evasion techniques such as packet randomization, residential proxies, and migration to I2P; law enforcement has disrupted some networks but the threat persists for devices with default credentials.