Mirai was first documented in 2016, when a self-spreading worm began conscripting home cameras, DVRs, and routers into one of the largest attack fleets ever assembled. It still matters because the device population it fed on never went away, and the fleets it builds are exactly what a DDoS test is meant to stand in for. Mirai is a botnet malware family: it is DDoS infrastructure, not an attack vector itself, so its whole significance is in the source model it creates.
What made Mirai different
The mechanics of enrolment are the ordinary botnet story, told in two sentences: Mirai scanned the internet for devices, logged into the ones it could, installed its payload, and pointed the freshly infected host at more targets to scan. What made it notable was not the method but where it pointed: consumer IoT, the softest and most numerous target pool on the internet.
Three details are specific to Mirai and worth knowing because a realistic test model depends on them. First, it spread over Telnet on ports 23 and 2323 using a hardcoded table of roughly sixty factory default credential pairs, the logins that ship on cheap cameras and DVRs and that owners almost never change. That short list was enough to assemble hundreds of thousands of bots, because the devices are numerous, always on, and unpatched. Second, its command channel could fire around ten distinct attack modules on demand, including SYN, ACK, UDP, GRE, and HTTP floods, so a single fleet could pivot vector without changing membership. Third, the code was built to hold territory: on infection it killed competing malware and closed the very Telnet port it arrived through, keeping the device for itself.
In late September 2016 the author, using the handle Anna-senpai, published Mirai's full source code on a hacking forum. That release is why the family still matters. The leaked source spawned a long line of variants (Satori, Okiru, Masuta, and Mozi among them) that recycle the same scanning-and-flooding engine against new device classes and new default-credential lists. The lineage is alive, not historical.
The attacks that defined it
Mirai drove several record-breaking events in a matter of weeks. In September 2016 it hit the security journalist Brian Krebs' site with a flood measured near 620 Gbps, large enough that his mitigation provider dropped the pro-bono arrangement rather than keep absorbing it. Around the same time a European hosting provider reported traffic approaching 1 Tbps from a Mirai fleet, the first credible terabit-scale attack in public.
The most consequential incident came on October 21, 2016, when a Mirai-based fleet aimed a flood of DNS traffic at a large managed-DNS provider. Because so many well-known services resolved their names through that provider, the attack made a swath of the internet unreachable for hours without touching any of those services' own servers. It was the clearest demonstration that a botnet's leverage is not just bandwidth but where it aims: the shared infrastructure everyone depends on.
What a DDoS test measures about it
Mirai set the template for the modern volumetric and connection-level threat: hundreds of thousands of always-on, geographically scattered real hosts producing L4 and L7 floods on command. The lesson for a test is that the source model matters as much as the bit rate. A defense tuned against a handful of loud sources collapses when the same volume arrives spread across tens of thousands of residential addresses, each individually under the per-source rate limit that would otherwise catch it.
A test that models a Mirai-class source set therefore assumes wide IP dispersion, real hosts that can complete handshakes and hold sessions, and sustained throughput rather than a brief burst. It also has to assume the fleet can switch vector mid-attack, because that on-demand module set is precisely what the command-and-control channel was built to do. Reproducing that behaviour, many real sources and a mix of flood types fired together, is what separates a meaningful result from a single-box load test that proves almost nothing. How a fleet like this is exercised across the several vectors it can fire at once is described in multi-vector DDoS testing.