Key takeaways

• Darktrace identified a camera device infected with the Mirai/Katana botnet in a sports-sector customer environment, showing how exposed IoT devices can become active participants in wider attack chains.
• The compromise involved suspicious Wget behavior, file downloads from rare external IPs, unusual incoming HTTP connections to video recorder management interfaces, and large outbound data transfers to infrastructure associated with botnet activity.
• The incident highlights the importance of extending visibility and response beyond traditional endpoints, as unmanaged or overlooked connected devices can be exploited for command-and-control, malware delivery, and data exfiltration.

Mirai and the Katana variant

Mirai is a botnet that first emerged in August 2016 and is well known for launching large-scale distributed-denial-of-service (DDoS) attacks, typically targeting exposed Internet of Things (IoT) devices. It identifies vulnerable IoT devices ,often by abusing default credentials or exposed services, and recruiting them into a remotely controlled botnet that can be used in DDoS campaigns [1].

Katana, one of the many variants that arose after Mirai’s source code was released publicly, was first observed in late 2020 and has been seen using more advanced capabilities, including custom command-and-control (C2), persistence mechanisms, and DDoS functionality [2].

In March 2026, research from the Nokia Deepfield Emergency Response Team (ERT) identified Katana as a Mirai-derived DDoS botnet targeting Android-based TV set-top boxes through exposed Android Debug Bridge (ADB) access.  Observed capabilities included custom C2, runtime domain rotation, multiple DDoS methods, and an on-device compiled kernel rootkit used for persistence and stealth [3].

Darktrace’s detection of Mirai Botnet activity on a camera device

In early 2026, Darktrace identified a Network/Digital Video Recorder (NVR/DVR) on the network of a sports-sector customer that had been infected with the Mirai Katana botnet and subsequently used to exfiltrate data from the customer’s environment. Seemingly related follow-up activity was observed on the same device several months later.

In both instances, the Darktrace Security Operations Centre (SOC) alerted the customer as part of the Managed Threat Detection (MTD) service. However, as Darktrace’s Autonomous Response capability was not fully enabled on the affected device, Darktrace was unable to proactively block the suspicious activity or prevent the compromise from continuing and recurring.

The initial compromise appears to have occurred when the affected device was seen using Wget to download Linux-based Executable and Linkable Format (ELF) files from a rare external IP, 195.177.94[.]105, which had not previously been observed in the customer’s network. Further analysis downloaded file hashes identified files related to the Mirai botnet.

Within a few hours, Darktrace detected the device uploading close to 3GB of data to another external IP, 50.7.49[.]4:3017 (ASN AS30058 FDCSERVERS), suggesting that the activity was likely routed via a virtual private server (VPS) hosted by FDC Servers [2]. Attackers often abuse VPS infrastructure from legitimate cloud providers to blend in with legitimate traffic and evade IP reputation and geolocation-based detections.

Darktrace continued to observe similar data transfers to multiple rare endpoints  including 171.225.223[.]53, 95.161.128[.]62, 61.7.209[.]88, 95.161.128[.]62, which have been linked to Mirai by open-source intelligence (OSINT).

Exploitation continued

Several months later, Darktrace identified the same exfiltration pattern on the device again, this time with stronger indications of associations with Mirai Katana botnet infection.

The device received incoming HTTP connections from 129.121.114[.]124, an external IP known to be associated with the Katana botnet IP [3]. The connections targeted the ‘/dvr/cmd’ path using the root username and user agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246.

The ‘/dvr/cmd’ path appears to be associated with the affected device’s web management functionality. This API endpoint has historically been targeted by Mirai and other IoT botnets through the exploitation of critical command injection vulnerabilities and automated botnet exploitation [4].

A few days later, Darktrace observed the Wget utility being used to download ELF files, including “/lil”,  from the IP 129.121.114[.]124. OSINT reporting has since associated this IP address with the Mirai Katana botnet. Notably, the IP observed earlier in the year, 195.177.94[.]105, had also hosted a file named “lil”, indicating a link between the observed activity.

Over the following days, the device received a sudden spike in connections from multiple rare external endpoints, suggesting a possible successful brute force attack. Darktrace also observed the device exfiltrating just under 4GB of data to another Mirai-associated IP address,  66.92.198[.]194, over ports 3344, 954922, and 80. Finally, the device was seen uploading data to the Mirai botnet IP 5.175.249[.]53 over port138 and exhibited an increase in UDP connections to 34.18.28[.]10 over port 9068.

Following both file download events, Darktrace identified spikes in external data transfers and connection attempts to rare destinations. While Darktrace’s Threat Research team could not confirm with high confidence that this to activity was directly associated with Mirai, it may indicate that Mirai Katana includes data exfiltration functionality.

Darktrace’s threat researchers also identified an internet-facing NTP server belonging to a separate customer receiving incoming connection attempts from the same initially observed IP, 195.177.94[.]105,over the port 123. This suggests that Mirai Katana may not exclusively target IoT devices.

Conclusion

This case demonstrates how threat actors can exploit overlooked IoT and OT devices to support broader malicious objectives. Here, a camera device infected with a botnet was used to exfiltrate data from the customer's environment, showing how peripheral assets can become active participants in an attack chain.

This case also reinforces a challenge many organizations face today: extending security visibility beyond traditional endpoints and servers. Cameras, sensors, and other connected devices often operate with limited monitoring and may fall outside established security processes, despite maintaining network connectivity and access to potentially sensitive environments. This is particularly relevant in the sports sector, where growing reliance on connected cameras, smart stadium technologies, and other IoT devices continues to expand the attack surface, as highlighted in Darktrace's Sports Sector Threat Report.

As botnets like Kata and Mirai continue to evolve, defenders need visibility across unmanaged IoT and edge devices, as well as security solutions that can recognize subtle deviations in device behavior that may indicate an emerging compromise.

Credit to Parvatha Ananthakannan (Cyber Analyst), Signe Zaharka (Principal Analyst)

Edited by Ryan Traill (Content Manager)

Appendices

Darktrace Model Detections

·      Anomalous File / EXE from Rare External Location

·      Anomalous File / Multiple EXE from Rare External Locations

·      Device / Initial Attack Chain Activity

·      Unusual Activity / Unusual External Data to New Endpoint

·      Anomalous Connection / Data Sent to Rare Domain

·      Unusual Activity / Enhanced Unusual External Data Transfer

·      Anomalous Connection / Uncommon 1 GiB Outbound

·      Device / Significant UDP Increase

·      Anomalous Connection / Low and Slow Exfiltration to IP

·      Compromise / Large Number of Suspicious Failed Connections

·      Compromise / Large Number of Suspicious Successful Connections

·      Unusual Activity / Unusual External Activity

·      Compliance / SSH to Rare External Destination

·      Unusual Activity / Unusual DNS

·      Device / External Network Scan

·      Device / Suspicious DNS Activity

·      Device / Large Number of Model Alerts

List of Indicators of Compromise (IoCs)

MITRE ATT&CK Mapping

The UK’s National Cyber Security Centre (NCSC) recently published guidance on managing the cyber risk of agentic AI. While the document is framed as interim advice as more formal guidance is developed, the framing reflects the current state of the industry: organizations are already deploying agents into production environments while standards, controls, and operating models for autonomous systems remain unsettled. Governance is evolving alongside adoption rather than preceding it, a reality which underscores the importance of robust controls.  

The NCSC’s guidance recommends aligning controls to an agent's level of autonomy, assigning distinct identities, limiting permissions, constraining access to systems and data, monitoring activity, maintaining human oversight, and preserving the ability to intervene when necessary. Most of these recommendations will sound familiar to security teams. The challenge is not the novelty of the controls. It is the type of system those controls now need to govern.

The shift from model security to agent security

For several years, AI security discussions have focused heavily on models. Can a model be manipulated? Jailbroken? Trusted? Can it expose information it should not? Those questions remain important, but they capture only part of the problem. A model generating text is one thing. A system connected to identities, applications, tools, workflows, and business data is another.

The difference becomes clearer when comparing a chatbot that answers questions with an agent that can retrieve customer records, update tickets, invoke tools, trigger workflows, and interact with external systems. The underlying model may be identical. Its access is not. The security question begins to shift from what the model knows to what the system can do.

The same theme appears in the Five Eyes statement released earlier this year, describing AI as a force multiplier that is accelerating both offensive and defensive cyber operations. The NCSC guidance explores what that reality looks like when autonomous systems begin operating inside enterprise environments.

Securing AI agents in operation

The NCSC spends relatively little time debating model behavior and considerably more time discussing identity, permissions, monitoring, oversight, containment, and response. Agents are treated as participants within an environment rather than isolated pieces of technology.  

That's broadly consistent with how we think about the problem at Darktrace.

An agent should not be treated as an extension of a user account. It develops its own behavioral patterns. It accesses systems, interacts with data, invokes tools, and moves across workflows in ways that can be observed independently. Understanding what an agent is permitted to do matters. Understanding how it actually behaves once deployed, and whether that behavior aligns with business intent, matters just as much.

Identity provides an obvious example. The NCSC recommends assigning distinct identities to agents rather than allowing them to disappear into surrounding human or service accounts. Most importantly, assigning agents distinct identities enables independent behavioral monitoring.

Development assumptions vs. real-world behavior

The same principle extends to monitoring. NCSC guidance places agent activity within normal security operations rather than treating it as a separate AI governance function. Many of the controls described are put in place before an agent begins operating. Sandboxing, credential design, approval workflows and human oversight all reflect judgments about how the system is expected to behave and what risks it is likely to create.

Actual use may challenge those assumptions. Access patterns change. Workflows expand. Systems begin interacting with resources they have never touched before. Processes that appeared reasonable during design behave differently in production. Human oversight requirements may turn out to be either excessive or inadequate once the system is operating at scale and operating within the context of unique business processes.

The Five Eyes statement points to a similar issue: organizations need confidence that controls continue to work as intended once systems are exposed to real users, data, tools and operational pressures. Often, the question is not whether an agent is technically allowed to perform an action, but whether its behavior remains consistent with the role it was intended to play.

Monitoring and governance of AI agents go hand-in-hand

This problem is exactly why monitoring and governance should be treated as part of the same process. Governance sets the initial parameters for deployment, while monitoring provides evidence about whether those parameters remain appropriate. That evidence should, in turn, inform changes to permissions, controls and oversight.

This matters increasingly as autonomous systems are integrated into business processes. The relevant risk is shaped not only by the model or agent itself, but by what it can access, what actions it can take, and how its behavior changes in practice.

Developing continuous oversight of AI agent behavior

The implication is clear: governance cannot end at deployment. Organizations need a way to understand how agents behave after deployment, test whether controls remain appropriate, and adjust them as conditions change. That requires visibility not just into technical activity, but into whether that activity makes sense in the context of the business process the agent is intended to support.

This is where business-centric behavioral security can become critical. Risk does not emerge from the model itself: it emerges from the actions an autonomous system takes within the enterprise and the downstream consequences of those actions.  

An agent can operate exactly as intended and still create risk if it accesses sensitive information in an unexpected context, exercises permissions in ways that create unintended exposure, or influences business processes in ways that were not anticipated during design and review.

Traditional governance vs. behavioral security

Traditional governance frameworks provide assurance at a point in time. Behavioral security can provide ongoing visibility into how autonomous systems interact with the organization they are meant to serve. Rather than focusing exclusively on model performance or policy compliance, organizations need to understand whether an agent's behavior aligns with business intent, operational expectations, and acceptable risk tolerances as conditions change.

As enterprises move from isolated AI deployments to interconnected ecosystems of agents, visibility into behavior becomes as important as visibility into code. Governance determines what an autonomous system is permitted to do. Behavioral analytics helps determine what it is doing, what business outcomes it is producing, and whether those outcomes remain aligned with the organization's objectives.

‍

[related-resource]