On April 13, 2026, the primary threat activity consisted of widespread malware distribution campaigns targeting IoT devices and end-user systems. Analysis of 51 malicious URLs reveals two distinct attack patterns: a large-scale Mirai botnet campaign distributing multi-architecture payloads from compromised infrastructure, and an ongoing ClearFake social engineering operation delivering remote access trojans. The Mirai activity demonstrates sophisticated cross-platform targeting with binaries compiled for 17 different architectures, indicating preparation for mass IoT device compromise. Additionally, the Mozi botnet variant continues to propagate through vulnerable network devices across multiple geographic regions.
The ClearFake campaign employed fake browser update prompts to distribute GuLoader and NetSupport RAT payloads through multiple rotating domains. This represents a continuation of established threat actor TTPs leveraging social engineering to bypass technical controls. No critical vulnerabilities, law enforcement actions, or significant policy changes were reported during this period. Organizations should prioritize IoT security hardening, network segmentation, and user awareness training focused on fake update scams.
Coordinated distribution of Mirai malware variants targeting diverse IoT device architectures from multiple command and control servers
Distribution server at 43.228.157.127 hosting Mirai 'TitanJr' variant compiled for 17 different architectures including ARM (5/6/7), MIPS, x86 (32/64-bit), i486, i686, m68k, ARC, and SPARC. Multiple download paths (/huhu/ and root) suggest redundancy for payload delivery.
Server at 46.151.182.82 distributing cryptocurrency mining malware targeting i686 architecture Linux systems, likely exploiting vulnerable IoT devices for cryptojacking operations.
Continued Mozi botnet expansion through vulnerable network devices across Asian and South American networks
Eight distinct IP addresses observed distributing Mozi botnet payloads targeting ARM and MIPS architectures. Geographic distribution includes IP ranges in China (110.37.x.x, 182.121.x.x, 223.151.x.x), South America (201.149.x.x), and other regions. Consistent use of high-numbered ports (33456-60492) and /bin.sh delivery mechanism indicates automated exploitation of known IoT vulnerabilities.
Active ClearFake operation utilizing fake browser update prompts to deliver remote access trojans through multiple rotating domains
Fourteen malicious domains identified distributing GuLoader and NetSupport remote access trojans through fake browser update social engineering. Domains use multiple subdomain patterns (cash-guys.in.net, disas5embsilence.in.net, clean-sorted.in.net) with consistent URI path structure, indicating coordinated infrastructure. GuLoader serves as initial stage loader for deploying NetSupport RAT for persistent remote access.
Common tactics, techniques, and procedures observed across malware campaigns
Threat actors compiled Mirai payloads for 17 distinct processor architectures, demonstrating sophisticated preparation for broad IoT device compromise. This approach maximizes infection potential across diverse embedded systems including routers, cameras, DVRs, and other connected devices with varying CPU architectures.