Mirai is the botnet everyone associates with cheap cameras and home routers. JPCERT/CC has just published a quarter of sensor data that complicates that picture. When its analysts went looking for the source of a sharp spike in Mirai-like scanning, what answered on the other end was not a webcam. It was a web hosting control panel.
The finding comes from TSUBAME, the network threat monitoring system JPCERT/CC runs across sensors in Japan and abroad, in its quarterly write-up for April to June 2026 by information security analyst Keisuke Shikano.
A telnet spike with the wrong sources
Packets aimed at port 23, the old telnet service that Mirai has always hunted for, surged on April 30 and then tailed off through early May. That part was ordinary. What was not ordinary was the source list: many of the addresses belonged to hosting providers, and opening them in a browser produced cPanel administration interfaces.
JPCERT is careful about what it claims from that. Observation data alone cannot establish the cause, the report says. It points instead at two other parties that were looking at the same window: a Censys blog post and published analysis from the NICTER Analysis Team, both of which suggest the increase may have been tied to Mirai or its variants exploiting a vulnerability in cPanel and WHM, tracked as CVE-2026-41940. JPCERT describes that flaw only in the terms the advisory supports, as one that could let an attacker bypass authentication and compromise the affected system. We covered the exploitation of that cPanel bug when it first surfaced in June. The report also notes that other kinds of damage, unrelated to Mirai infections, have been reported.
Servers can be bots too
The scale is worth sitting with. Traffic originating from Japan and aimed at port 23 rose to roughly fifteen times its pre-surge level at the peak, with a large share coming from addresses assigned to hosting providers. Broken down by region, the United States accounted for the largest share of the packets overall, with sharp increases around May 1 in Germany, France and Canada as well. JPCERT reads the shifting regional distribution as a sign the infections were spread broadly across the internet rather than concentrated anywhere in particular.
The lesson JPCERT draws is a simple one that gets lost in the shorthand. Mirai and its variants are generally associated with IoT devices, but infections are not limited to them. A rented server is a far better botnet node than a doorbell camera: more bandwidth, more compute, and an owner who is not watching it the way they watch a laptop.
The quarter's wider port data is unremarkable by comparison, which is itself informative. Port 23 topped the list on most sensors, though some saw more traffic to 443, and scanning against ports 80, 8080 and 22 turned up on very nearly every sensor, which JPCERT reads as background activity being run across a wide range of networks rather than anything targeted. No activity this quarter warranted an extra issue or a special alert.
Patch, restrict, then change the passwords
JPCERT's guidance is the same regardless of what kind of device is involved: address vulnerabilities promptly, restrict remote access, and replace weak passwords. For anyone running a hosting panel, the first of those is the one that matters here, and the relevant fix has been available for months.
If you think a machine is already infected, the report suggests reviewing running processes and network communications, paying particular attention to whether the system is doing what it is supposed to be doing. On a server that is quietly scanning port 23 across the internet, outbound connection volume is usually the tell long before anything on disk is.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.