public-research/datasurge/report.md at main · deepfield/public-research

First published: 2026-06-04

Executive summary

Most Mirai forks spread first and ask questions later. They brute-force telnet, chain CVEs, scan port ranges, and race to claim as many devices as possible before the next reboot clears them from memory. Datasurge does not. It has no propagation scanner, no credential list, and no exploit integration. The operator appears to place each bot via ADB exploitation and then invests the development effort that other forks spend on spreading into makin…