At 11:10 UTC on October 21, 2016, the DNS provider Dyn began absorbing a flood of TCP and UDP traffic aimed at port 53 of its managed DNS platform. Within the hour, users of the many sites that relied on Dyn's points of presence in the eastern United States, where the attack concentrated, found that familiar websites would not load, not because those sites were down but because the system that translated their names into addresses had been overwhelmed. Dyn later confirmed that the bulk of the traffic came from devices infected with Mirai, and estimated the botnet behind it at up to 100,000 endpoints.
Ten years on, that Friday remains the moment the public learned what a botnet of cheap connected devices could do. Mirai itself was crude. It scanned the internet for devices that answered on telnet, tried a list of 62 factory default usernames and passwords, and conscripted anything that let it in: digital video recorders, security cameras, home routers. At its height at the end of November 2016, researchers counted roughly 600,000 infected devices.
A season of records
The Dyn attack was the third major event in a two month run. In September 2016 the botnet hit the website of a security journalist with traffic that exceeded 600 Gbps, and around the same time it battered the hosting company OVH. On September 30, 2016 the malware's author published the source code on a criminal forum, a move that Cloudflare's account of the episode suggests was meant to hide the origins of the earlier attack. Copies and variants multiplied within weeks. By the Justice Department's account the original authors' involvement ended when the code was posted; Cloudflare attributes the Dyn attack to others running the leaked code.
Dyn's analysis shows how messy a large DNS flood becomes. Beyond the attack packets, recursive resolvers around the world began retrying failed lookups, generating 10 to 20 times normal traffic and making the botnet appear far larger than it was. Some observers put the attack at 1.2 Tbps; Dyn said it could not verify that figure. A second wave arrived at 15:50 UTC, and residual effects lasted into the evening.
Routers in Germany, pleas in Alaska
The next shock came in late November 2016, when a Mirai variant probing the remote management interfaces of home routers left some 900,000 Deutsche Telekom customers with broken or crippled connections. The company said the attack failed to infect its routers but crashed four to five percent of them, and it pushed firmware updates while telling customers to unplug their devices for 30 seconds to clear the malware from memory. Kaspersky identified the code as a Mirai descendant, and Germany's Federal Office for Information Security confirmed that maintenance interfaces were being attacked worldwide.
By December 2017 the people behind the original botnet had admitted it in court. That month the Justice Department announced that Paras Jha, Josiah White and Dalton Norman had entered guilty pleas in federal court in Alaska to conspiracy charges for creating and running Mirai. Jha and Norman also admitted running a click fraud botnet of more than 100,000 devices, and Jha separately pleaded guilty to attacks on Rutgers University. Two of the three had run a DDoS mitigation business, selling protection against the kind of attack they were launching.
What a botnet looks like a decade later
Mirai's source code never went away, and the lineage is visible in the figures from 2025 and 2026. Cloudflare says it mitigated 47.1 million DDoS attacks in 2025, more than double the year before, including a 31.4 Tbps attack that lasted 35 seconds. The largest campaign of the quarter that followed came from Aisuru and its Android offshoot Kimwolf, a network of an estimated one to four million infected hosts made up largely of Android TV boxes, which turned on Cloudflare's own infrastructure in December 2025. During the first six months of 2026 the company counted 935 network layer attacks above 1 Tbps, a size that would have sounded like fiction in 2016.
Those two botnets were among four whose infrastructure the Justice Department, working with Canada and Germany, seized in March 2026. Prosecutors put the combined total at three million hijacked devices and more than 300,000 attacks, launched from the same digital video recorders, cameras and routers that Mirai favored, plus the television boxes. Five months later Kaspersky documented malware built specifically for Android car head units from the Chinese supplier DoFun, delivered through the units' own update channel and designed to turn them into nodes of a proxy botnet linked to the BadBox operation. The vendor said it had fixed the distribution flaw.
The botnets of 2026 spread through firmware backdoors, abused update channels and residential proxy networks rather than open telnet ports, but the economics are the ones Mirai exploited: a device its owner has no reason to clean, a manufacturer with little reason to patch, and a rental market that pays whoever controls the most of them. One thing has changed for the worse. Dyn's engineers needed more than two hours to fully deploy their defenses against the first wave in 2016. The record attacks Cloudflare absorbed in 2025 and 2026 were over in 35 seconds, before anyone could have picked up a phone.
