Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW

Mirai IZ1H9 Botnet: Linux Server Threat Analysis

Palo Alto Networks
07/20/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


which exploits vulnerabilities in Linux-based servers and networking devices. The variant targets devices running Linux and uses vulnerabilities like Tenda G103 command injection, lblink command injection, dcn dcbi-netlog.lab remote code execution, and zyzexel remote code execution. Once compromised, these devices can be controlled by attackers and used for distributed denial-of-service attacks. Palo Alto Network's next generation firewall offers protection against this variant through cloud-delivered security services, including IoT security, advanced threat protection, wildfire, and advanced URL filtering. Unit 42 researchers have observed multiple campaigns using the IZ1H9 variant since November 2021, suggesting the work of a single threat actor based on similarities in malware and infrastructure. The variant connects to a hard-coded command and control, or C2, address and employs an encrypted string table for configuration. It leverages default login credentials for SSH and telnet channels and exploits remote code execution vulnerabilities for HTTP channel access. Applying patches and updates is crucial to mitigate the risk posed by this variant. Palo Alto Networks provides comprehensive protection to its customers against the Mirai IZ1H9 variant.

TL;DR

  • Unit 42 discovered the IZ1H9 Mirai variant exploiting vulnerabilities in Linux servers and networking devices from vendors including Tenda, lblink, DCN, and Zyxel.
  • Compromised devices are recruited into a botnet for DDoS attacks, with the malware using hardcoded C2 addresses and encrypted configuration tables.
  • Palo Alto Networks offers protection through cloud-delivered services including IoT security, advanced threat protection, WildFire, and URL filtering.

Summary

This threat briefing from Unit 42 examines the IZ1H9 variant of the Mirai botnet, first discovered in April and actively targeting Linux-based servers and networking devices since November 2021. The variant exploits multiple vulnerabilities including command injection flaws in Tenda G103 and lblink devices, as well as remote code execution vulnerabilities in DCN and Zyxel equipment. Once compromised, devices are recruited into a botnet capable of launching distributed denial-of-service attacks. The malware connects to hardcoded command and control infrastructure, uses encrypted configuration tables, and spreads through default SSH and telnet credentials alongside HTTP-based exploitation. Palo Alto Networks positions its next-generation firewall with cloud-delivered security services—including IoT security, advanced threat protection, WildFire, and advanced URL filtering—as comprehensive protection against this threat. The briefing emphasizes that consistent campaign patterns suggest a single threat actor behind IZ1H9 operations, and recommends patching as the primary mitigation strategy.

Chapters

0:00 - IZ1H9 Variant Discovery
0:15 - Targeted Vulnerabilities
0:44 - Protection Solutions
1:04 - Threat Actor Analysis

Key Quotes

0:00 "On April 10th, researchers at Unit 42 discovered a new variant of the Mirai botnet named IZ1H9, which exploits vulnerabilities in Linux-based servers and networking devices."
1:04 "Unit 42 researchers have observed multiple campaigns using the IZ1H9 variant since November 2021, suggesting the work of a single threat actor based on similarities in malware and infrastructure."
1:29 "Applying patches and updates is crucial to mitigate the risk posed by this variant."

FAQ

What devices are targeted by the Mirai IZ1H9 variant?

The IZ1H9 variant targets Linux-based servers and networking devices, specifically exploiting vulnerabilities in Tenda G103, lblink, DCN dcbi-netlog, and Zyxel equipment through command injection and remote code execution flaws.

How can organizations protect against this Mirai variant?

Organizations should apply patches and updates to vulnerable devices, change default login credentials for SSH and telnet, and deploy security solutions with IoT protection and advanced threat detection capabilities.


Categories:
  • » Cybersecurity » Network Security
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Threat Intelligence
  • IoT Security
  • Network Security
  • Technical Deep Dive
  • Mirai botnet
  • IZ1H9 variant
  • Linux security
  • IoT vulnerabilities
  • DDoS attacks
  • Command injection
  • Remote code execution
  • Threat intelligence
  • Network device security
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Mirai IZ1H9 Botnet: Linux Server Threat Analysis

              Upcoming 360 View Events

              • Nov
                19

                360View: Govern, Secure & Recover Your Microsoft 365 Environment

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Oct
                  27

                  Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action

                  10/27/202611:00 AM ET
                  • Oct
                    28

                    EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

                    10/28/202601:00 PM ET
                    • Nov
                      12

                      Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

                      11/12/202601:00 PM ET
                      More events

                      Industry Events (Sponsor Hosted)

                      • Oct
                        20

                        Master Data Governance for AI with Cyera and Snowflake Insights

                        10/20/202611:00 AM ET
                        • Oct
                          27

                          Maximize Security, Value, and Profit from Your Microsoft Investment

                          10/27/202611:00 AM ET
                          • Oct
                            27

                            The HUMAN Experience: Real-Time Insights into Page Intelligence

                            10/27/202601:00 PM ET
                            • Oct
                              28

                              Ensuring AI Security Across the APAC Region

                              10/28/202601:00 AM ET
                              • Oct
                                28

                                EMEA: Ensuring Comprehensive Security for AI Applications

                                10/28/202606:00 AM ET
                                More events

                                Upcoming Webinar Calendar

                                • 10/20/2026
                                  11:00 AM
                                  10/20/2026
                                  Master Data Governance for AI with Cyera and Snowflake Insights
                                  https://www.truthinit.com/index.php/channel/2137/master-data-governance-for-ai-with-cyera-and-snowflake-insights/
                                • 10/27/2026
                                  11:00 AM
                                  10/27/2026
                                  Maximize Security, Value, and Profit from Your Microsoft Investment
                                  https://www.truthinit.com/index.php/channel/2178/maximize-security-value-and-profit-from-your-microsoft-investment/
                                • 10/27/2026
                                  11:00 AM
                                  10/27/2026
                                  Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action
                                  https://www.truthinit.com/index.php/channel/2182/see-it-stop-it-contain-it-lateral-movement-defense-in-action/
                                • 10/27/2026
                                  01:00 PM
                                  10/27/2026
                                  The HUMAN Experience: Real-Time Insights into Page Intelligence
                                  https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
                                • 10/28/2026
                                  01:00 AM
                                  10/28/2026
                                  Ensuring AI Security Across the APAC Region
                                  https://www.truthinit.com/index.php/channel/2125/ensuring-ai-security-across-the-apac-region/
                                • 10/28/2026
                                  06:00 AM
                                  10/28/2026
                                  EMEA: Ensuring Comprehensive Security for AI Applications
                                  https://www.truthinit.com/index.php/channel/2127/emea-ensuring-comprehensive-security-for-ai-applications/
                                • 10/28/2026
                                  01:00 PM
                                  10/28/2026
                                  AMERICAS: Safeguarding AI Across All Fronts
                                  https://www.truthinit.com/index.php/channel/2126/americas-safeguarding-ai-across-all-fronts/
                                • 10/28/2026
                                  01:00 PM
                                  10/28/2026
                                  EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure
                                  https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
                                • 11/04/2026
                                  11:00 AM
                                  11/04/2026
                                  Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions
                                  https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
                                • 11/05/2026
                                  02:00 PM
                                  11/05/2026
                                  HUMAN Dialogue: Embracing the Era of AI-Driven Consumers.
                                  https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-era-of-ai-driven-consumers/
                                • 11/05/2026
                                  02:00 PM
                                  11/05/2026
                                  Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption
                                  https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
                                • 11/12/2026
                                  01:00 PM
                                  11/12/2026
                                  Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision
                                  https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
                                • 11/19/2026
                                  01:00 PM
                                  11/19/2026
                                  360View: Govern, Secure & Recover Your Microsoft 365 Environment
                                  https://www.truthinit.com/index.php/channel/2076/360view-govern-secure-recover-your-microsoft-365-environment/
                                • 11/19/2026
                                  01:00 PM
                                  11/19/2026
                                  Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents
                                  https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
                                Truth in IT
                                • Sponsor
                                • About Us
                                • Terms of Service
                                • Privacy Policy
                                • Contact Us
                                • Preference Management
                                Desktop version
                                Standard version