“ChaCha20 for the static config table (the first time we have seen ChaCha20 used this way in a Mirai variant), a single static byte (0xED) for everything on the wire, a named reverse-shell protocol (SHELL / SHOUT) on the same channel as attack commands, and a DNS misdirection scheme that swaps the two 16-bit halves of every resolved A record before connect().”

Nokia Deepfield · said date not stated · reported 2026-10-23

Nokia Deepfield researchers described Potassium as a Mirai fork with novel encryption and protocol features.