Sophos

“A resolver function supports IPv4 addresses and hostname resolution, with additional fallback resolution logic that includes hard-coded public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1,”

Sophos · said date not stated · reported 2026-10-23

Sophos detailed the resolver function and fallback DNS logic in the malware sample.

“As with Mirai malware historically, this sample can execute DDoS attacks.”

Sophos · said date not stated · reported 2026-10-23

Sophos noted the Potassium botnet sample retains DDoS attack capabilities consistent with Mirai malware.

“The sample displays downloader and network disruption functionality.”

Sophos · said date not stated · reported 2026-10-23

Sophos described the functionality of the Mirai-derived botnet sample found in the attacks.

“However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026,”

Sophos · said date not stated · reported 2026-10-23

Sophos analyzed a malware sample linked to the Potassium botnet variant exploiting PHP2Shell vulnerabilities.