They don't need to. Millions of devices have their telnet port open to the Internet (just check Shodan), after infecting those, Mirai has a beach head to scan and attack the rest of the network.