Why Your Router Might Be Quietly Attacking Websites Right Now — And You'd Never Know

Picture this: you're running a small business. Your security cameras keep an eye on the front door. Your router hums along in the back office. Your smart thermostat adjusts the AC. Everything seems fine.

But behind the scenes, one of those devices has been silently recruited into a digital army — and right now, it's helping take down someone else's website, send spam, or worse. You'd never notice. Your internet might be a little slower. That's it.

This isn't hypothetical. It's happening right now, powered by a piece of malware called Mirai — and a fresh variant just showed up on threat trackers in early April 2025.

What Is Mirai, and Why Should You Care?

Mirai first made global headlines in 2016 when it knocked major websites offline — Twitter, Netflix, Reddit, and Spotify all went dark because of a massive flood of internet traffic. That flood didn't come from some supercomputer in a villain's lair. It came from hundreds of thousands of ordinary devices: home routers, security cameras, baby monitors, DVRs.

Mirai is malware designed to infect these kinds of "Internet of Things" (IoT) devices — basically anything that connects to the internet but isn't a traditional computer. Once infected, the device becomes a "bot" in a "botnet" — think of it as a zombie in a zombie army, following orders from a remote commander.

The scary part? The original Mirai source code was released publicly in 2016. That means anyone with moderate technical skills can modify it, give it a new name, and send it out hunting for victims. And that's exactly what keeps happening, years later.

The New Sample: "TitanJr"

ThreatChain recently flagged a fresh Mirai variant called titanjr.arm5. Let's break down what we know.

The file itself is tiny — about 90 kilobytes, smaller than most photos on your phone. It's an ELF file (that's the program format used by Linux, the operating system running inside most routers and IoT devices). Specifically, it's compiled for ARM processors — the same kind of chip inside your smart home gadgets, cheap routers, and IP cameras.

It was first spotted on April 5, 2025, and it surfaced from infrastructure traced back to Germany, though Mirai botnets are global operations. Multiple security vendors — Kaspersky, Intezer, Triage, and others — all independently flagged it as malicious. On VirusTotal (a service where files are scanned by dozens of antivirus engines), 31 out of 76 scanners detected it as a threat, which is a strong consensus that this file is genuinely dangerous.

The name "TitanJr" suggests this is part of a lineage — likely a variant built by someone tweaking an existing Mirai offshoot, giving their botnet a brand name the way gangs tag their territory.

How It Gets In (It's Embarrassingly Simple)

Here's the part that frustrates security professionals: Mirai doesn't use some brilliant, never-before-seen hacking technique. It does something much simpler.

It scans the internet looking for devices that still use default usernames and passwords. Think "admin/admin" or "root/12345." That's it. That's the break-in.

Imagine you bought a house, and the builder left the front door key under the mat. You never moved it. Mirai is someone driving through every neighborhood, checking under every mat, and walking right in.

Once inside a device, the malware does a few key things:

1. It digs in. Security researchers flagged this sample with rules related to "persistence" — the malware's ability to survive a reboot and stick around. Think of it as the intruder not just breaking in, but changing the locks so you can't easily kick them out.

2. It phones home. The malware connects to a command-and-control server (C2) — essentially a remote control operated by whoever deployed it. Through this connection, your device receives instructions: attack this website, scan for more victims, download an update.

3. It attacks on command. The primary use of Mirai botnets is launching DDoS attacks — Distributed Denial of Service. Imagine a thousand people simultaneously trying to squeeze through a single doorway. No one gets through. That's what happens to a website when thousands of infected devices all flood it with traffic at once. Businesses go offline. Revenue stops. Customers leave.

Who's Actually at Risk?

If you own any internet-connected device that isn't a regular computer or phone, you could be affected. Specifically:

• Home routers (especially older or budget models)
• IP security cameras and DVR systems
• Smart home devices — thermostats, smart plugs, even smart fridges
• Network-attached storage (NAS) devices used for backups
• Small business point-of-sale systems running embedded Linux

Small businesses are especially vulnerable because they often buy IoT equipment, set it up once, and never touch it again. No firmware updates. No password changes. The device works fine, so why mess with it?

Meanwhile, the other victims are the targets of the botnet's attacks — websites, online stores, game servers, even hospitals and government services that get knocked offline by the traffic flood your compromised camera is helping generate.

The Real-World Impact

This isn't abstract. DDoS-for-hire services powered by Mirai botnets can be rented for as little as $20. A disgruntled competitor could pay to take your online store offline during a big sale. A hacker could extort a small SaaS company: "Pay us or we keep your service down."

And for the device owner? Your internet slows down. Your bandwidth gets eaten up. In some cases, the malware opens a backdoor that could be used for more invasive attacks later — stealing credentials, pivoting into your local network, accessing files on connected drives.

You become both an unwitting accomplice and a potential future victim.

What You Can Do Right Now

The good news: protecting yourself from Mirai variants doesn't require a security degree. Here are five concrete steps:

1. Change every default password. Go through every device on your network — router, cameras, smart plugs, NAS boxes — and make sure none of them still use the password they came with. This single step blocks Mirai's primary entry method.

2. Update your firmware. Log into your router's admin panel (usually by typing 192.168.1.1 into your browser) and check for updates. Do the same for cameras and other connected devices. Manufacturers patch known vulnerabilities in firmware updates, but only if you actually install them.

3. Disable remote management if you don't need it. Many routers and cameras have a feature that lets you manage them from outside your home network. If you're not actively using this, turn it off. It's an open door you probably don't need.

4. Reboot your IoT devices periodically. Many Mirai variants live only in memory — meaning a reboot clears them out. This isn't a permanent fix (they can reinfect if your password is still weak), but combined with a password change, it's a clean start.

5. Consider network segmentation. This sounds fancy, but many modern routers let you set up a "guest network." Put your IoT devices on the guest network and your computers and phones on the main one. That way, even if a camera gets compromised, the attacker can't easily jump to your laptop or file server.

The Bottom Line

Mirai isn't new. It isn't sophisticated. And that's exactly what makes it dangerous — it exploits the simplest, most widespread security mistake there is: leaving the default password on a device you forgot about.

The titanjr.arm5 sample is just the latest reminder that this problem hasn't gone away. Someone, somewhere, is still building these botnets, still scanning the internet, still finding thousands of devices with the front door wide open.

Don't let yours be one of them.

Sample Details for Security Teams & the Curious