Brian Krebs accuses founder of DDoS mitigation provider ProTraf Solutions as co-author of Mirai IoT worm; founder denies involvement
Brian Krebs / Krebs on Security :
Context & Ripple Effects
Mirai has shadowed Brian Krebs personally since the worm's operators knocked KrebsOnSecurity offline, and the story escalated when the Mirai source code was publicly released, letting anyone spin up copycat botnets — including the one behind the DynDNS outage powered by XiongMai-component DVRs and cameras.
This report closes part of that loop: Krebs alleges the founder of ProTraf Solutions, itself a DDoS mitigation provider, co-authored the worm — an accusation landing on someone whose business sells protection from exactly this threat. The founder denies involvement, so the claim is contested, not adjudicated.
First-order effects
- ProTraf Solutions' founder now faces public attribution as an alleged Mirai co-author while denying it — a direct reputational threat to a firm whose product depends on customer trust in its ethics.
- Krebs is both the accuser and a prior victim here: the same worm he is attributing was used against KrebsOnSecurity, making this investigation personal as well as journalistic.
Second-order effects
- Customers evaluating DDoS mitigation vendors get a new diligence question — whether the people selling protection can be tied to the attacks — pressuring ProTraf's sales pipeline if the allegation gains traction.
- The open-source release means Mirai-derived botnets keep generating demand for mitigation services regardless of who wrote the original, so rivals in the mitigation market can absorb any ProTraf defections without the underlying threat shrinking.
Third-order effects
- If journalist-led attribution keeps outpacing law enforcement on IoT malware, unsecured device makers like XiongMai face mounting pressure to answer for hardware that turns into attack infrastructure — shifting liability conversations toward device manufacturers.
- A contested accusation against a security vendor, unresolved between allegation and denial, points toward an industry where attribution itself becomes a competitive weapon and reputation risk is priced into security procurement.
The trend: IoT botnet attribution is moving from anonymous criminal forums to named, commercially entangled individuals, with journalists doing the naming and victims' businesses absorbing the fallout.