Malware & RansomwareHIGH

Mirai Malware Threatens Japan's IoT Devices in 2025

#Mirai#IoT#DDoS#Japan#cybersecurity

Original Reporting

JPJPCERT/CC

AI Intelligence Briefing

CyberPings AIΒ·Reviewed by Rohit Rana
Severity LevelHIGH

Significant risk β€” action recommended within 24-48 hours

🦠
🦠 MALWARE PROFILE
Malware Nameβ€”
Malware Typeβ€”
Threat Actorβ€”
Target Platformβ€”
Delivery Methodβ€”
Persistence Mechanismβ€”
C2 Infrastructureβ€”
Capabilitiesβ€”
IOCs Availableβ€”
Detection Rateβ€”
MITRE ATT&CKβ€”
🎯

Basically, Japan's IoT devices are being targeted by malware that can take control of them.

Quick Summary

Japan's IoT devices are under siege from Mirai malware, with alarming spikes in attacks. This affects anyone with smart devices at home. Protect your devices by updating firmware and securing your settings.

What Happened

In a concerning trend, Japan's IoT devices are facing a surge in attacks linked to Mirai malware. The latest TSUBAME Report Overflow highlights alarming data collected from January to March 2025, revealing that packets directed to port 23/TCP, a common target for such malware, have spiked. This is particularly troubling because Mirai malware can turn unsuspecting devices into part of a botnet, which attackers use for various malicious activities.

The report indicates that during specific periods in fiscal year 2024, over 50% of packets sent to port 23/TCP showed characteristics of Mirai. Notably, these packets were identified from various devices, including routers, security cameras, and DVRs. The data suggests that attackers are not only scanning for vulnerabilities but also attempting to exploit these devices by targeting multiple ports.

Why Should You Care

If you own any Internet-connected devices, this news is crucial for you. Imagine your smart camera or router being hijacked by a hacker. Your personal data and privacy could be at risk, and your devices could be used in attacks against others. Just like leaving your front door unlocked makes it easy for intruders to enter your home, failing to secure your devices makes them vulnerable to malware like Mirai.

Everyday actions, like not updating your device firmware or using default passwords, can leave you exposed. It's essential to take proactive steps to protect your devices from becoming unwitting participants in cyberattacks. By understanding these threats, you can better safeguard your home and your information.

What's Being Done

The TSUBAME project is actively monitoring these trends and sharing insights with local product developers and Internet Service Providers (ISPs). Here are some immediate actions you should consider:

  • Update your device firmware regularly to patch security vulnerabilities.
  • Change default settings and passwords on your devices to make them harder to exploit.
  • Conduct port scans to check for unnecessary open ports that could be targeted by attackers.

Experts are keeping a close eye on the evolving tactics of attackers and will continue to provide valuable data to help mitigate these threats. As the landscape of cyber threats evolves, staying informed and vigilant is key to protecting your devices and personal information.

Pro Insight

πŸ”’ Pro insight: The resurgence of Mirai highlights the persistent vulnerabilities in IoT devices, necessitating a shift towards more robust security protocols.

Sources

Original Report

JPJPCERT/CC
Read Original

Also covered by

CYCyber Security News

Mirai-Based Botnets Evolve Into Massive DDoS and Proxy Abuse Threat

Read

Related Pings

HIGHMalware & Ransomware

Malicious Chrome Extension - Injects Malware in Browsers

A new malicious Chrome extension, Amazing Refresh, is hijacking user clicks and monetizing traffic without consent. This poses risks to both users and website owners. Immediate action is needed to remove the extension and protect users.

Scott HelmeΒ·
HIGHMalware & Ransomware

NightSpire Ransomware - Analyzing Evolving IOCs and TTPs

A recent NightSpire ransomware incident shows how evolving tactics complicate detection and recovery. Organizations must adapt to these changes to protect their data.

Huntress BlogΒ·
HIGHMalware & Ransomware

Storm-1175 - High-Tempo Medusa Ransomware Operations Unveiled

Storm-1175 has been identified as a rapidly executing ransomware group that exploits newly disclosed vulnerabilities to deploy Medusa ransomware within 24 hours. Their tactics pose significant risks to various sectors, especially healthcare and finance.

Microsoft Security BlogΒ·
HIGHMalware & Ransomware

Trojanized PyPI AI Proxy Steals User Data Silently

The hermes-px package on PyPI poses a significant threat to developers, exfiltrating sensitive data while masquerading as a legitimate AI tool. New insights reveal advanced evasion techniques and a focus on academic users.

Cyber Security NewsΒ·
HIGHMalware & Ransomware

Malicious Strapi NPM Packages Target Guardarian Users

36 malicious NPM packages targeting Strapi users have been discovered, capable of executing shells and harvesting credentials. The attack exploits Redis and PostgreSQL vulnerabilities, posing significant risks to Guardarian's ecosystem.

SecurityWeekΒ·
HIGHMalware & Ransomware

ILSpy Domain Compromised - Malware Delivered to Developers

Hackers have compromised the ILSpy domain, redirecting users to a malicious site that delivers malware disguised as a browser extension. This attack primarily targets developers and poses significant risks to sensitive data.

Cyber Security NewsΒ·