Mirai IZ1H9 Botnet: Linux Server Threat Analysis

Name: Mirai IZ1H9 Botnet: Linux Server Threat Analysis
Uploaded: 2026-07-20T06:14:47-04:00
Duration: 1 min 47 s
Description: TL;DR Unit 42 discovered the IZ1H9 Mirai variant exploiting vulnerabilities in Linux servers and networking devices from vendors including Tenda, lblink, DCN, and Zyxel. Compromised devices are recruited into a botnet for DDoS attacks, with the malware...

Palo Alto Networks

07/20/2026

0 (0%)

Report Like Favorite

TL;DR

Unit 42 discovered the IZ1H9 Mirai variant exploiting vulnerabilities in Linux servers and networking devices from vendors including Tenda, lblink, DCN, and Zyxel.
Compromised devices are recruited into a botnet for DDoS attacks, with the malware using hardcoded C2 addresses and encrypted configuration tables.
Palo Alto Networks offers protection through cloud-delivered services including IoT security, advanced threat protection, WildFire, and URL filtering.

Summary

This threat briefing from Unit 42 examines the IZ1H9 variant of the Mirai botnet, first discovered in April and actively targeting Linux-based servers and networking devices since November 2021. The variant exploits multiple vulnerabilities including command injection flaws in Tenda G103 and lblink devices, as well as remote code execution vulnerabilities in DCN and Zyxel equipment. Once compromised, devices are recruited into a botnet capable of launching distributed denial-of-service attacks. The malware connects to hardcoded command and control infrastructure, uses encrypted configuration tables, and spreads through default SSH and telnet credentials alongside HTTP-based exploitation. Palo Alto Networks positions its next-generation firewall with cloud-delivered security services—including IoT security, advanced threat protection, WildFire, and advanced URL filtering—as comprehensive protection against this threat. The briefing emphasizes that consistent campaign patterns suggest a single threat actor behind IZ1H9 operations, and recommends patching as the primary mitigation strategy.

Chapters

0:00 - IZ1H9 Variant Discovery
0:15 - Targeted Vulnerabilities
0:44 - Protection Solutions
1:04 - Threat Actor Analysis

Key Quotes

0:00 "On April 10th, researchers at Unit 42 discovered a new variant of the Mirai botnet named IZ1H9, which exploits vulnerabilities in Linux-based servers and networking devices."
1:04 "Unit 42 researchers have observed multiple campaigns using the IZ1H9 variant since November 2021, suggesting the work of a single threat actor based on similarities in malware and infrastructure."
1:29 "Applying patches and updates is crucial to mitigate the risk posed by this variant."

FAQ

What devices are targeted by the Mirai IZ1H9 variant?

The IZ1H9 variant targets Linux-based servers and networking devices, specifically exploiting vulnerabilities in Tenda G103, lblink, DCN dcbi-netlog, and Zyxel equipment through command injection and remote code execution flaws.

How can organizations protect against this Mirai variant?

Organizations should apply patches and updates to vulnerable devices, change default login credentials for SSH and telnet, and deploy security solutions with IoT protection and advanced threat detection capabilities.

Categories:

» Cybersecurity » Network Security
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Illumio + Netskope: Zero Trust in the Age of AI Autonomy

Ask Your Cloud Anything: Unlocking Governance Silos in your Environments

Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue

Becoming Agent Ready: Insights from Cyera's Expertise