Loading story…
Researchers reported continued evolution of the Go-based BotenaGo malware family, which was previously observed targeting millions of routers and IoT devices with more than 30 embedded exploits. A newly identified derivative, dubbed Lillin scanner, narrows that broad approach and instead focuses on Lilin security camera DVRs, reusing portions of leaked BotenaGo source code while dropping most of the original exploit set.
The malware attempts HTTP basic authentication with 11 hardcoded credential pairs and exploits an older critical command-injection flaw in the DVR's NTP configuration interface by sending crafted POST requests to /dvr/cmd or /cn/cmd. Successful compromise causes the device to fetch wget.sh from 136.144.41[.]169, which then downloads and executes Mirai binaries for multiple CPU architectures. Researchers said the tool appears designed for manual or semi-manual targeting rather than fully autonomous worm-like propagation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The source code for BotenaGo was leaked in October 2021. Later malware analyzed by Nozomi reused portions of that leaked codebase.
The Lilin DVR vulnerability set later targeted by the Lillin scanner was discovered in 2020. The command-injection flaw in the NTP configuration interface was assigned a CVSS v3.1 score of 10.0 by the vendor.
Researchers discovered and analyzed a BotenaGo-like malware sample targeting Lilin security camera DVR devices, naming it "Lillin scanner" after the source-code path /root/lillin.go. The sample focused on exploiting the older Lilin DVR flaw and ultimately deployed Mirai payloads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet and other reporting identified **Nexcorium**, a Mirai-derived malware strain targeting Internet of Things devices, particularly **TBK DVR-4104** and **DVR-4216** video recorder systems used with security cameras. The campaign exploits **`CVE-2024-3721`**, an OS command injection flaw, to run a downloader script that retrieves malware binaries for multiple Linux architectures. Fortinet linked the activity to a suspected actor it calls **Nexus Team**, citing the custom HTTP header `X-Hacked-By: Nexus Team – Exploited By Erratic.` Once installed, Nexcorium uses classic Mirai-style scanner, watchdog, and attack modules, establishes persistence through mechanisms including init, `rc.local`, systemd, and cron, and spreads further through brute-force Telnet activity, default-password abuse, and exploitation of **`CVE-2017-17215`** in Huawei HG532 devices. The malware performs self-checks, replication, and self-deletion to improve resilience and evasion, then connects to the command-and-control domain `r3brqw3d[.]b0ats[.]top` to receive instructions for **DDoS** operations, including UDP, TCP SYN, TCP ACK, SMTP, and VSE query floods.
Jun 29, 2026
Researchers reported multiple fast-moving IoT/Linux botnet campaigns built from **Mirai** and **Gafgyt** code that aggressively targeted embedded devices through known vulnerabilities and, in some cases, credential brute forcing. Palo Alto Networks said the campaigns—linked to evolutions of **Omni**, **Okane**, and **Hakai**—combined as many as 11 exploits in a single sample and introduced new distributed denial-of-service techniques, while related **Gafgyt** malware added an `HTTPCF` Layer 7 attack command aimed at Cloudflare-protected URLs. One newly adopted vector was the unauthenticated remote command execution flaw in **D-Link DSL-2750B** routers, which attackers incorporated shortly after public exploit tooling became available. The activity mirrors earlier reporting on **IoT_reaper**, a rapidly spreading botnet that also favored exploit-driven propagation over Mirai-style weak-password attacks. Netlab 360 said Reaper integrated at least nine exploits across products from **D-Link, Netgear, Linksys, AVTECH, GoAhead, JAWS,** and **Vacron**, maintained multiple command-and-control components, and at one point showed more than 10,000 daily active bot IPs on a tracked server, with millions of vulnerable devices queued for infection. Together, the reports show botnet operators quickly weaponizing public disclosures and modules to compromise internet-exposed routers and cameras at scale, then repurposing those infections for DDoS and broader botnet operations.
Aug 15, 2026
A remote command execution zero-day in Merit LILIN DVR and NVR devices was exploited in the wild to spread **Mirai** malware, according to 360 Netlab. The flaw affected the `GET /getclock` interface, where the `NTP_SERVER` parameter was not properly validated and could be injected into a shell command via `syscmd` and shared memory. Attackers reportedly combined the bug with default credentials to compromise exposed devices, and telemetry from 360 Netlab's Anglerfish honeypot showed exploitation activity tied to Mirai propagation infrastructure. The researchers said they reported the issue to Merit LILIN, which released a firmware fix identified as version `4.0.26.5618`, with firmware resources made available through the vendor's support channel. Netlab estimated that more than **1 million** internet-exposed devices matched LILIN DVR fingerprints and that **6,748** were likely vulnerable at the time of analysis. The report also documented affected firmware names, malware hashes, and download URLs associated with the campaign, underscoring the risk to organizations still running unpatched or default-configured surveillance systems.
Aug 15, 2026