Mirai was an IoT botnet from 2016-2017 that was used in some of the largest DDoS attacks in history up until that point. It mainly abused bad default credentials in IoT devices to spread, and used a decentralized P2P C2 approach that made it very hard to take down.

Resources

USENIX Security 2017 - Understanding the Mirai Botnet

USENIX Security ’17 - Understanding the Mirai Botnet

• really good breakdown of how Mirai was tracked, how it was made up, etc.
• broke down how Mirai was clustered
• broke down why Mirai was a big deal
• interesting breakdown on Mirai’s DDoS methodologies

IEEE - The Strange Story of the Teens Behind the Mirai Botnet

The Strange Story of the Teens Behind the Mirai Botnet

This is a really great writeup on the Mirai botnet’s authors, where it came from and how it was used.