public-research/jackskid/report.md at main · deepfield/public-research

Reverse-engineering Jackskid: from bare-bones Mirai fork to persistent TV box

botnet

Nokia Deepfield Emergency Response Team (ERT) and Comcast Threat Research Lab (CTRL) First published: 2026-03-24

Content warning: This report quotes malware artifacts verbatim, including domain names, C2 strings, and build paths chosen by the threat actors. Some contain crude or offensive language. These are reproduced exactly as found in samples to enable accurate detection and attribution.

Note: Since this research was completed, Jackskid and three related botnets have been disrupted by law enforce…