broadside

Broadside is a Mirai-derived botnet variant targeting the maritime logistics sector by exploiting CVE-2024-3721 in TBK DVR digital video recording devices deployed on seagoing vessels. It is associated with attacks against exposed onboard surveillance and recording infrastructure, using remote command injection to compromise devices and fold them into botnet operations. The malware departs from more conventional Mirai tradecraft through stealthier persistence and process control. Reported behavior includes Netlink-based process monitoring for persistence, dynamic termination and blacklisting of competing processes, attempts to harvest system credential material, and activity consistent with privilege escalation and lateral movement from compromised devices. Broadside also uses custom command-and-control communications and high-rate UDP flooding, with payload polymorphism and other defense-evasion measures intended to reduce static detection. Operationally, Broadside poses particular risk to maritime environments because vessel networks often contain legacy and poorly monitored systems, limited onboard security staffing, and constrained satellite connectivity. Botnet activity on infected marine assets can therefore degrade vessel operations and consume expensive bandwidth. Broadside is best understood as an IoT-focused botnet threat actor or operation centered on maritime targeting rather than a clearly attributed nation-state group.