Satori
Satori is a Mirai-based IoT botnet, also referred to as Okiru, first identified in late 2017. It is known for extremely rapid propagation, with reporting in the provided content stating it infected more than 260,000 devices or routers within about 12 hours shortly after discovery. The malware targets internet-exposed routers and other embedded/IoT systems, particularly small-office/home-office and residential devices, and is used for botnet expansion and distributed denial-of-service activity.
The content directly associates Satori with exploitation of multiple router vulnerabilities. Reported infection vectors include the GPON router flaws CVE-2018-10561 and CVE-2018-10562 affecting DASAN Zhone Solutions devices, where Satori was observed incorporating the GPON exploit into later variants. The content also states Satori exploited a vulnerability in D-Link DSL-2750B devices, described elsewhere in the provided material as an OS command injection issue, and that it has been linked by Netlab 360 to exploitation of CVE-2018-10088 on Xiongmai devices. Additional reporting in the content says Satori appeared to target Huawei Home Gateway routers, and that its tradecraft has been referenced in relation to exploitation of Realtek/miniigd-exposed devices on port 52869.
Operationally, Satori is described as a Mirai-derived self-propagating botnet that scans for vulnerable IoT devices and integrates exploit code to compromise them at scale. One provided technical reference notes that Satori-style propagation included downloading and executing binaries for multiple CPU architectures to maximize infections. The malware is repeatedly discussed in the context of DDoS botnet ecosystems and modern Mirai variants.
High-confidence associations in the content include its classification as a Mirai variant/botnet, alias Okiru, rapid mass infection of routers, targeting of Huawei Home Gateway and other IoT/router platforms, and exploitation links to GPON vulnerabilities, D-Link DSL-2750B flaws, and CVE-2018-10088. No actor attribution beyond its placement in the broader Mirai-derived botnet ecosystem is directly established in the provided content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Satori Botnet — The infamous botnet that infected 260,000 devices in just 12 hours last year, Satori (also known as Okiru) has also been observed to include GPON exploit in its latest variant. | Gigabit-capable Passive Optical Network (GPON) routers manufactured by DASAN Zhone Solutions have been found vulnerable to an authentication bypass (CVE-2018-10561) and a root-RCE (CVE-2018-10562) flaws that eventually allow remote attackers to take full control of the device.
Gigabit-capable Passive Optical Network (GPON) routers manufactured by DASAN Zhone Solutions have been found vulnerable to an authentication bypass (CVE-2018-10561) and a root-RCE (CVE-2018-10562) flaws that eventually allow remote attackers to take full control of the device. | Satori Botnet — The infamous botnet that infected 260,000 devices in just 12 hours last year, Satori (also known as Okiru) has also been observed to include GPON exploit in its latest variant.
the first exploit used by Okiru is linked to the CVE-2014-8361... Devices using the Realtek SDK with the miniigd daemon are vulnerable to OS command injection attacks in the UPnP SOAP interface.
the botnet is co-located with a Xiongmai NVR/IP camera’s HTTP server... correlate three known vulnerabilities this server is affected by: CVE-2017-7577, CVE-2018-10088, and CVE-2022-45460... CVE-2018-10088, in particular, is already associated with the Satori, Hajime, and BotenaGo botnets.
CVE-2018-10888, in particular, is already associated with the Satori, Hajime, and BotenaGo botnets.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
Execution
2 techniques
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
2 techniques
Credential Access
Discovery
1 technique
Discovery
Lateral Movement
1 technique
Lateral Movement
Command and Control
5 techniques
Command and Control
recent data reveals a worrying trend: the number of servers used to control botnets ... jumped by 24% in the last half of 2025.
The “wget” command is used to perform an HTTP request to download the malicious payload and store it on the device as filename “c”. Then, the same kind of SOAP request, but with a modified command injection, is performed to execute the payload.
“Evasive command-and-control techniques, including domain-fluxing and encrypted command channels.”
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named DDoS botnet referenced as having previously used the same Realtek router targeting approach.
A Mirai variant that infected large numbers of routers by exploiting a flaw in D-Link DSL-2750B devices.
Mirai-derived IoT botnet that spreads by exploiting remote code execution and command injection flaws in routers and similar edge devices, downloading architecture-specific payloads to maximize infections.
A Mirai variant/fork referenced as part of the modern generation of IoT botnets used for DDoS, benefiting from Mirai-style automated exploitation and propagation across insecure IoT devices.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.