Mirai Botnet Variants Fuel Record-Breaking DDoS Attacks in 2025–2026 The Mirai botnet, first discovered in 2016, has evolved into a sprawling cybercriminal ecosystem, driving a surge in botnet-driven threats over the past year. Originally designed to hijack IoT devices running on ARC processors often by exploiting default credentials or unpatched vulnerabilities Mirai’s source code release enabled threat actors to develop hundreds of variants, targeting millions of devices worldwide. In 2025, Spamhaus reported a 26% increase in botnet command-and-control (C2) servers in the first half of the year, followed by a 24% rise in the latter half. The U.S. surpassed China as the top host of these servers, a position China had held since late 2023. Among the most destructive variants, Aisuru and Kimwolf collectively known as Aisuru-Kimwolf compromised 1–4 million devices, powering some of the largest DDoS attacks on record, including a 31.4 Tbps flood and a 14.1 billion packet-per-second assault. Beyond DDoS, the botnets monetized access to infected devices via platforms like Discord and Telegram, while also abusing residential proxy networks to obscure attack traffic. On March 19, 2026, the U.S. Department of Justice, in coordination with Canada and Germany, disrupted C2 servers linked to Aisuru, Kimwolf, JackSkid, and Mossad, though the botnets quickly adapted. Kimwolf, an Android-focused subvariant, infected 2 million devices by distributing malicious .apk files targeting multiple CPU architectures. After Google and the DOJ dismantled its IPIDEA proxy infrastructure, Kimwolf shifted to The Invisible Project (I2P), a decentralized, encrypted network that complicates tracking and takedown efforts. This rapid pivot underscores the operators’ ability to evade law enforcement by rerouting infrastructure in real time.