Ghosts in the Network: Extending Mirai to Understand Modern DDoS Evasion

I rebuilt the leaked Mirai IoT botnet from source, stood up a full multi-architecture C2/loader/bot lab in an isolated virtual network, and then engineered four DDoS evasion modules (connection-persistence flooding, IP fragmentation abuse, source-address spoofing, and TCP flag manipulation) designed to defeat the signature- and volume-based defenses that neutralized the original 2016 attack. I mapped each technique to concrete detection and mitigation controls. This post covers the system architecture, the technical mechanics of each add-on, how each is actually stopped, and how the findings hold up against what's happened in the DDoS threat landscape since.

Background: Why an Almost-Decade-Old Botnet Is Still Worth Studying

Mirai's 2016 campaign — the Krebs on Security attack (over 600 Gbps) and the Dyn DNS attack (~1 Tbps) that took down Twitter, GitHub, and Netflix — didn't rely on a novel exploit. It relied on scale: a Telnet-based dictionary attack against ~60 hardcoded default credential pairs, run against a population of IoT devices (routers, DVRs, IP cameras) with essentially no security posture. The attack was loud, high-volume, and unauthenticated by design, which is exactly why it was eventually easy to fingerprint and filter.

Ten years later, the underlying vulnerability class hasn't gone away — Fortinet, Akamai, and others are still tracking new Mirai derivatives exploiting fresh CVEs in DVRs and routers in 2026 — but the defensive landscape has matured substantially. Volumetric floods now get caught by rate-limiting and anomaly detection within seconds. The interesting research question, and the one this project is built around, is: what does a DDoS botnet look like once it stops relying on raw volume and starts optimizing for evasion instead?

System Architecture

To answer that, we needed a faithful, controllable reproduction of Mirai's operational model, not a toy simulation. The lab consisted of:

• C2 (Command & Control) server — issues attack commands to registered bots over a custom TCP protocol, tracks bot check-ins, and exposes an operator CLI.
• Loader module — receives reports of vulnerable devices from the scan listener, performs the Telnet login, and pushes the correct architecture-specific binary (ARM, MIPS, x86) via wget/tftp-style payload delivery — mirroring how real Mirai distributes cross-compiled binaries to heterogeneous IoT hardware.
• Scan listener — receives results from bots performing stateless SYN scans of the (isolated) IP range for open Telnet ports (23/2323), then hands candidates to the loader for credential brute-forcing.
• Bots — Ubuntu ARM VMs configured with intentionally weak Telnet credentials, running the actual Mirai bot binary, capable of receiving and executing attack commands from the C2.
• Victim — a Windows Server ARM VM standing in for a production service, instrumented with Wireshark and tcpdump for full packet capture during every test run.

Everything ran on ARM VMs via UTM on Apple Silicon hosts, which turned out to be non-trivial in itself: Mirai's original build system depends on cross-compilers for MIPS/ARM/SuperH that have since been pulled from mainstream package repositories. Getting a clean build required pulling archived toolchains, patching deprecated syscalls and networking APIs against the current kernel/libc, and containerizing the build environment for reproducibility — closer to doing digital archaeology than to git clone && make.

Embedded content

The Four Evasion Modules

Each module targets a specific assumption baked into conventional DDoS defense: that attacks are loud, complete, honestly-addressed, and protocol-conformant.

1. Slow-and-Low / APDoS (defeats volume-based detection)

Mechanism: Rather than a burst of traffic, bots open a large number of TCP connections to the target and send data at a deliberately throttled rate — just enough to reset the server's idle-connection timer, never enough to register as a bandwidth spike. This is architecturally the same class of attack as Slowloris (incomplete HTTP headers) and RUDY (slow POST bodies), generalized to the transport layer: the goal is to exhaust the target's finite connection table (conntrack entries, socket file descriptors, thread pool workers) rather than its bandwidth. We layered in gradual traffic escalation and packet-type diversification specifically to defeat anomaly detectors that baseline on rate-of-change rather than absolute volume.

Why it evades naive defenses: Most firewall/IDS rate-limiting is keyed on packets-per-second or bytes-per-second thresholds. A connection sending one byte every 20 seconds never crosses those thresholds, no matter how many thousand such connections exist simultaneously.

Defense: Move from throughput-based to state-based monitoring — track concurrent-connections-per-source, connection age distributions, and per-connection throughput, and flag sources holding open abnormally many long-lived, low-byte-rate sessions. Aggressive but tunable idle-timeouts, and reverse proxies/WAFs with dedicated slow-client detection (mod_reqtimeout-style, or the equivalent in modern ADCs), close most of this gap.

2. Fragmentation-Based Floods (defeats signature-based filtering)

Mechanism: IPv4 fragmentation lets a sender split a packet across multiple IP datagrams, which the receiver must buffer and reassemble using the fragment offset field before it can inspect the payload. We generate oversized packets with deliberately irregular fragment offsets and inconsistent sizes, sent at irregular intervals. The receiving stack has to allocate reassembly buffers and hold state per fragment train; a flood of incomplete or overlapping fragment sets forces excessive memory/CPU allocation to reassembly logic that most inline inspection devices treat as a lower-priority path than whole-packet filtering.

Why it evades naive defenses: Signature-based IDS/IPS typically inspects complete packets or reassembled streams. Fragments below the inspection engine's reassembly threshold, or with offsets chosen to break naive reassembly logic, can pass through un-inspected or trigger disproportionate resource consumption relative to their size.

Defense: Enforce strict reassembly timeouts and reject packets with anomalous or overlapping fragment offsets (a known technique from classic teardrop-style attacks). Rate-limit fragmented traffic as its own class, separate from whole-packet traffic, and where the protocol allows it, block fragmentation at the network edge entirely (Path MTU Discovery removes most legitimate need for it).

3. IP Spoofing (defeats blocklist/reputation-based filtering)

Mechanism: Bots forge the IPv4 source address field on outbound packets, so each blocked source is instantly replaced by an arbitrary, unrelated address on the next packet — including addresses drawn from geographically diverse ranges to defeat geo-fencing. This is only possible because the attack is largely stateless (UDP-style or SYN-only) — it doesn't require completing a handshake, so the attacker never needs a real reply to come back to the spoofed address.

Why it evades naive defenses: Any defense keyed on "block this IP" or "this IP has bad reputation" degrades to nearly zero effectiveness once the attacker can present an unlimited stream of never-before-seen source addresses.

Defense: This is fundamentally a network-layer problem, not an endpoint one. BCP38 / RFC 2827 (source-address validation / egress filtering) at the ISP and network edge prevents spoofed packets from ever leaving the network they originated in — if every access-network router dropped outbound packets whose source address didn't belong to its own assigned range, spoofing would be structurally impossible. Adoption remains inconsistent globally, which is why spoofing is still a live technique nearly a decade after Mirai. On the receiving side, unicast reverse-path-forwarding (uRPF) checks and upstream scrubbing/anycast absorption (Cloudflare, AWS Shield, Akamai Prolexic) mitigate what does arrive.

4. TCP Flag Manipulation / NULL Flood (defeats stateful inspection heuristics)

Mechanism: Standard TCP packets always carry at least one control flag (SYN, ACK, FIN, RST). We send packets with no flags set at all. This is neither a recognized attack signature (like a SYN flood) nor a protocol-conformant packet a real TCP stack would ever produce — it falls into an interpretive gap. Stateful inspection engines have to decide how to classify and track a packet that doesn't map cleanly onto any TCP state-machine transition, which measurably increases CPU load per packet compared to well-formed traffic, and in weaker implementations can crash or bypass session-tracking logic entirely.

Why it evades naive defenses: Most IDS/firewall rulesets are written as blocklists against known-bad flag combinations (SYN floods, Xmas-tree packets with all flags set). A packet with zero flags often isn't explicitly blocklisted, because it wasn't anticipated as a distinct attack category.

Defense: Flip the model from blocklist to allowlist at the protocol level — validate that every TCP packet's flag combination matches a set of legitimate state-machine transitions, and drop anything outside that set by default, rather than only filtering combinations that have previously been observed as malicious. This "default-deny on protocol structure" approach generalizes to the next flag-manipulation variant we haven't seen yet, which a purely signature-based rule never will.

What's Changing Right Now

Adaptive, feedback-driven, AI-tunable botnets are the natural next step for this line of research — and they're already operational at scale:

• Aisuru-Kimwolf, a Mirai-derived botnet of an estimated 1–4 million compromised IoT/Android devices, produced a record 31.4 Tbps / 14.1 billion packets-per-second attack in December 2025 — completing in about 35 seconds, faster than most threshold-based systems can react at all. In March 2026, the DOJ, working with Canadian and German counterparts, disrupted the C2 infrastructure behind Aisuru, KimWolf, JackSkid, and Mossad.
• Nexcorium (FortiGuard Labs) chains a DVR RCE vulnerability with an older Huawei router exploit in a single multi-architecture Mirai-style campaign — the "vulnerability scanning beyond default credentials" extension we scoped as future work is now standard tradecraft.
• xlabs_v1 targets ADB-enabled Android TV boxes and ships 21 distinct flood variants as a DDoS-for-hire product — the "diversify attack types" module we built is now a commercial feature.
• Industry-wide, AI-driven DDoS campaigns now rotate IPs, headers, and traffic signatures live, in direct response to whichever mitigation rule just triggered — an automated, real-time version of the "feedback-driven refinement" we described only conceptually.

Every evasion primitive in this project — persistence over volume, fragmentation over completeness, spoofing over honesty, protocol-flag ambiguity over known signatures — is now baseline in commercial botnet tooling, running at a scale that makes static defense obsolete. The lab's conclusion holds, just with much higher stakes: detection has to be behavioral and sub-second, because that's the entire lifespan of some of the largest attacks ever recorded.

Skills This Project Exercised

• Systems/build engineering: cross-compilation for MIPS/ARM against modern toolchains, containerized reproducible builds, patching deprecated syscalls
• Network protocol internals: TCP state machines, IP fragmentation/reassembly, source-address validation, packet-level analysis with Wireshark/tcpdump
• Threat modeling: structured adversary-profile / attack-vector / target-asset analysis (STRIDE-adjacent methodology) applied to a real malware family
• Defensive mapping: translating each offensive technique into concrete, implementable detection and mitigation controls rather than stopping at "here's an exploit".

Conclusion

Mirai isn't a museum piece — it's a chassis that's still being actively extended in the wild, at a scale now measured in tens of terabits per second. The value of a project like this isn't reproducing the attack; it's building the muscle to reason precisely about why a given evasion technique works, and translating that into defenses that generalize past the next variant. That's the skill set the field actually needs, on both the red and blue side.