Mirai-like botnet activity sharply increased in early May 2026 after attackers apparently compromised hosting servers running cPanel and WHM administration software.
Japan’s JPCERT/CC reported that its TSUBAME Internet threat-monitoring sensors detected a major rise in malicious packets targeting Telnet services over TCP port 23.
The surge began on April 30 and continued into early May before gradually declining. The traffic showed characteristics associated with Mirai and related variants.
Mirai is widely known for infecting exposed Internet-connected devices and using them as bots for scanning, brute-force attacks, and distributed denial-of-service operations.
However, the latest activity highlights that servers, not only consumer IoT devices, can also become part of botnet infrastructure.
Investigators found that many source IP addresses involved in the scanning activity were assigned to hosting providers.
When researchers accessed some of these addresses through a web browser, they found cPanel administration interfaces running on many of the systems.
The observation data alone could not confirm the initial compromise method. However, analysis published during the campaign linked the activity to possible exploitation of CVE-2026-41940, a vulnerability affecting cPanel/WHM.
The flaw could allow attackers to bypass authentication and take control of vulnerable systems.
Mirai Surges on cPanel
The spike was not limited to one country or hosting provider. The United States accounted for the largest share of observed source addresses, while Germany, France, and Canada also recorded sharp increases around May 1.
Traffic patterns showed that compromised systems were spread broadly across the Internet rather than concentrated in a single region. Japan also saw a similar jump in malicious traffic.
Packets originating from Japanese IP addresses and targeting TCP port 23 rose to roughly 15 times their normal level at the peak of the campaign.
The activity was especially notable because Telnet remains a common target for Mirai operators. Attackers often scan TCP port 23 to identify systems with exposed remote-management services. They may then attempt to log in using weak, default, or reused credentials.
TSUBAME sensor data also showed that 23/TCP was the most frequently targeted port across most monitored networks in Japan, North America, Europe, and other regions.
Other commonly scanned services included HTTPS on 443/TCP, HTTP on 80/TCP, SSH on 22/TCP, alternate web services on 8080/TCP, and Remote Desktop Protocol on 3389/TCP.
The incident underlines the need for hosting providers and server administrators to rapidly apply security updates, especially for Internet-facing management platforms such as cPanel/WHM.
Organizations should identify affected cPanel systems, apply vendor fixes for CVE-2026-41940 where available, and restrict access to administrative panels.
Management interfaces should not be openly exposed to the Internet unless necessary. Access should be limited through firewall rules, VPNs, IP allowlists, and multi-factor authentication, JPCERT said.
Administrators should also disable Telnet where possible and use SSH with strong authentication controls instead. Default credentials must be removed, passwords should be unique and strong, and unused services should be disabled.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
