Mirai-derived describes malware or botnets built from, modified from, or strongly influenced by the Mirai botnet family. Mirai is best known for compromising poorly secured IoT devices and turning them into remotely controlled bots, often for DDoS campaigns.
This label matters because Mirai code and tactics are widely reused: simple device scanning, default-credential abuse, lightweight payloads, and rapid replication across embedded systems. A Mirai-derived strain may keep the original botnet’s core behavior while adding new features such as stronger persistence, anti-removal tricks, or altered command-and-control traffic. In defense, the term helps analysts recognize a familiar threat model even when the malware is not an exact Mirai clone. Security teams may look for IoT exposure, unusual outbound connections, and signs that reboot or recovery behavior has been tampered with.