Mirai is a botnet lineage best known for infecting IoT devices and embedded Linux systems such as cameras, routers, and other small appliances. Once a device is compromised, the malware typically turns it into part of a remote-controlled fleet that can be used for distributed denial-of-service (DDoS) attacks and other large-scale abuse. Its success comes from targeting devices that are exposed to the internet, rarely monitored, and often protected by weak credentials or outdated firmware.
In cyber security, Mirai matters because it shows how quickly insecure edge devices can be weaponized at scale. Defenders often look for default-password abuse, unusual outbound traffic, suspicious process names, and signs of botnet command-and-control communication. Variants and descendants may add stealth features such as fileless execution, encryption, or process masquerading, but the core threat remains the same: many small, poorly secured systems can be combined into a powerful attack platform. Hardening IoT devices, changing defaults, limiting management exposure, and patching firmware are key defenses.