bk99.de entertain the web since 1997

bk99.de
KrebsOnSecurity · ResearchCurated

Who was Anna-Senpai? The trail behind Mirai

Summary

Brian Krebs links source code, forum profiles, chats, business relationships and DDoS motives into a detailed attribution of the Mirai author. Mirai’s source code was published on 30 September 2016. The command system was written in Go and the device software in C.

Ideas

  • Programming languages and publicly mentioned skills can link online identities.
  • Reused addresses, user names and contacts form robust investigative graphs.
  • Source code similarities complement social and business traces.
  • Botnet operators sold DDoS attacks and protection against those attacks at the same time.
  • Competition over Minecraft servers drove technical escalation and sabotage.
  • Published malicious code makes imitation easier but also reveals its origin.

Insights

  • Pseudonyms rarely break because of one piece of evidence, but because of many reused small details.
  • Economic motives often explain botnet conflicts better than technical curiosity.
  • Transparent chains of evidence make investigative attributions easier to verify.

Quotes

  • This story is the result of hundreds of hours of research. – Brian Krebs

Habits

  • Krebs documents contradictory clues, interviews the people involved and discloses the attribution steps.

Facts

  • The research identified Paras Jha as the presumed user behind Anna-Senpai.

References

Critique

  • The publication was a journalistic attribution and not yet a court ruling.
  • Individual clues would be ambiguous in isolation and only gain weight in the overall picture.

Remarks

  • Later guilty pleas confirmed central parts of the research.
  • The long text is also a case study in clean open source intelligence.

Recommendations

  • Assess identity clues only as an independent, chronologically ordered chain of evidence.
  • Preserve public artefacts together with their origin and retrieval time.
  • Keep technical attribution, motive and legal guilt strictly apart.

Read the original article

Search the Web Archive

KrebsOnSecurity · 2025

6.3 Tbit/s: What came after Mirai

Brian Krebs examines a short 6.3 Tbit/s attack and links it to Aisuru, compromised IoT devices and a publicly rented DDoS service. The attack reached more than 6.3 Tbit/s. Google measured around 585 million packets per second.

KrebsOnSecurity · 2016

620 Gbit/s: Mirai announces a new class of DDoS

Brian Krebs documents a DDoS attack that was exceptional at the time and whose direct traffic floods pointed to a large botnet of compromised IoT devices. The attack began on the evening of 20 September 2016. After analysis, Akamai put the peak load at around 620 Gbit/s.

KrebsOnSecurity · 2024

BlackCat: Ransom does not buy trust

Using the Change Healthcare case, Brian Krebs shows how a presumed multi-million payment, a cheated partner and remaining data undermine every promise of deletion. An attributed address received around 22 million dollars on 1 March. An affiliate continued to claim it held four terabytes of stolen data.