Mirai Variant V3G4 Targets IoT Devices
Summary: Unit 42 researchers observed a Mirai variant called V3G4 from July to December 2022, spreading through 13 vulnerabilities that lead to remote code execution on exposed Linux servers and networking devices. After exploitation, the malware runs wget and curl to download Mirai client samples, which print xXxSlicexXxxVEGA to the console, connect to a hardcoded C2, and can be commanded to launch DDoS attacks.
What you should know: The actor behind V3G4 ran three campaigns with the same tooling, and the September and December 2022 samples dropped the exploit and brute-force functions entirely - meaning the code is being reworked between waves while the 13 RCE vulnerabilities it targets remain the entry point.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026