Mirai-based botnet tried to hijack Deutsche Telekom, UK's TalkTalk and Post Office customer routers, disrupting internet access for over 1M customers
The Mirai worm also hit the broadband, internet and TV networks of 900,000 Deutsche Telekom customers — Around 100,000 Post Office …
Context & Ripple Effects
This attack is the direct downstream consequence of the public release of Mirai's source code two months earlier — anyone could now compile the worm that had already taken down KrebsOnSecurity with tens of thousands of hijacked devices. The December wave marks its evolution from a DDoS weapon aimed at websites into an attempt to conscript consumer broadband routers themselves at Deutsche Telekom, TalkTalk and the Post Office.
The scale matters: roughly 900,000 Deutsche Telekom and around 100,000 Post Office customers lost connectivity when the hijack attempts bricked or destabilized their own CPE, making this less a website outage than an ISP-side service disruption caused by the devices ISPs ship to subscribers.
First-order effects
- Over 1 million Deutsche Telekom, TalkTalk and Post Office customers lost broadband access as the botnet's hijack attempts crashed their routers, forcing the ISPs into emergency firmware fixes and mass customer reboots.
Second-order effects
- With the source code freely available, Mirai-derived botnets kept mutating rather than dying — by May 2017 they were being pointed at the hardcoded kill-switch domain of WannaCry in an attempt to revive the ransomware (Mirai botnets DDoSing WannaCry's kill-switch).
Third-order effects
- The pattern holds into a permanent tooling problem: Palo Alto Networks reported a new Mirai variant in 2019 expanding from routers into signage TVs and presentation systems (targeting signage and presentation displays), while researchers priced the original KrebsOnSecurity outage at hundreds of thousands of dollars borne by device owners — shifting liability toward whoever ships insecure connected hardware.
The trend: Leaked botnet source code is turning one-off DDoS weapons into self-perpetuating malware families that keep finding new classes of consumer and enterprise IoT devices to absorb.