The Rootkit in Your Living Room: Anatomy of the Katana Botnet a Mirai Variant
Katana is a Mirai-derived botnet built to compromise vulnerable IoT devices at scale through credential abuse, remote code execution and aggressive propagation – delivering stealth persistence…
- Botnet
- IoT
Bottom line. Katana turns weak, internet-exposed IoT devices into disposable DDoS bandwidth. The immediate priority is IoT hygiene: disable exposed management services, kill default credentials, patch firmware, and segment these devices away from anything that matters.
Background
Katana represents a highly aggressive Mirai-derived botnet capable of rapidly compromising internet-facing IoT systems. It leverages default credentials, weak authentication and exposed management interfaces to establish footholds and expand its infrastructure at scale.
The continued evolution of Mirai variants like Katana highlights the growing operational threat posed by insecure IoT ecosystems. Large-scale device compromise lets attackers generate massive attack bandwidth while maintaining resilient, globally distributed infrastructure.
What we observed
The botnet follows the classic Mirai lifecycle, extended with modular attack capabilities:
- Mass scanning: continuously scans public IP ranges for devices exposing Telnet, SSH or web administration interfaces.
- Credential abuse: brute-forces default and weak credentials to authenticate and gain a foothold.
- Payload delivery: deploys architecture-specific payloads to onboard devices into its command-and-control ecosystem.
- Modular DDoS: launches TCP floods, UDP floods and HTTP abuse in coordinated volumetric denial-of-service operations.
Katana infection & attack flow
Insecure IoT plus default passwords equals internet-scale, disposable attack bandwidth.
Attribution
Katana is a Mirai-derived botnet family; the malware source lineage is well established, but individual campaigns are operated by varied, typically financially or disruption-motivated actors rather than a single group. Attribution of specific operations should rely on infrastructure and telemetry rather than the family name alone.
Every unpatched camera and router with a default password is one more cannon the botnet points at someone else.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Reconnaissance | Active Scanning: Scanning IP Blocks | T1595.001 | Continuously scans public IP ranges for exposed Telnet, SSH and web admin services. |
| Credential Access | Brute Force | T1110 | Brute-forces default and weak credentials on exposed IoT management interfaces. |
| Command and Control | Ingress Tool Transfer | T1105 | Delivers architecture-specific payloads to onboard compromised devices. |
| Impact | Network Denial of Service | T1498 | Conducts coordinated TCP/UDP/HTTP volumetric denial-of-service attacks. |
Detection
Copy-ready hunting query:
# Outbound Telnet/SSH scanning from internal hosts = likely Mirai/Katana bot
index=netflow dest_port IN (23, 2323, 22)
| stats dc(dest_ip) as targets sum(bytes) as bytes by src_ip
| where targets > 200
| sort -targets
# On suspected IoT/Linux hosts: recently dropped executables in temp dirs
find /tmp /var/tmp /dev/shm -type f -perm -111 -newermt "2026-01-01" -ls 2>/dev/nullRecommendations
- Disable or restrict exposed management interfaces (Telnet, SSH, web admin) on IoT and embedded devices – put them behind a firewall or VPN and disable Telnet entirely where possible.
- Rotate default and weak credentials and enforce strong, unique passwords across all IoT and embedded systems.
- Patch IoT firmware promptly and segment IoT devices away from critical networks to limit blast radius.
- Monitor for outbound scanning bursts on ports 23/2323/22 and volumetric egress indicative of DDoS participation, and block known C2 where identified.
