Loading story…
Kaspersky researchers identified a new Mirai botnet variant exploiting CVE-2024-3721 in TBK digital video recorders (DVRs). Attacks observed in a Linux honeypot used crafted POST requests to execute shell commands and download an ARM32 malware binary from 42.112.26[.]36, suggesting the campaign was tailored to DVR hardware without requiring architecture reconnaissance. Telemetry placed affected devices primarily in China, India, Egypt, Ukraine, Russia, Türkiye and Brazil. Public-source analysis identified more than 50,000 internet-exposed DVRs as potential targets, not confirmed infections.
The variant complicates analysis through RC4-encrypted strings, an XOR-obfuscated encryption key, checks for VMware and QEMU-arm environments, and execution-path validation against hardcoded allowed directories. Kaspersky detects the threat as HEUR:Backdoor.Linux.Mirai and HEUR:Backdoor.Linux.Gafgyt. Organizations should assess exposed DVRs for vulnerability and compromise, apply firmware updates, replace default credentials, restrict remote access, isolate surveillance networks and monitor unusual traffic; Kaspersky also recommended factory-resetting vulnerable exposed devices where appropriate.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Analysis of public sources identified more than 50,000 DVR devices exposed online, highlighting potential targets requiring vulnerability assessment. This exposure count was not a count of confirmed infections.
Researchers identified RC4-encrypted strings, an XOR-obfuscated encryption key, checks for VMware and QEMU-arm, and execution-directory validation in the DVR-targeting bot. The technical report also published malware hashes and network indicators associated with the threat.
Kaspersky researchers observed attackers exploiting CVE-2024-3721 in a Linux honeypot to deploy a new Mirai variant targeting TBK DVR devices. A crafted POST request executed shell commands that downloaded and launched an ARM32 payload from 42.112.26[.]36.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new Mirai botnet variant known as **Broadside** has been identified targeting vulnerable *TBK Vision* digital video recorders (DVRs) used extensively in the maritime logistics sector. Researchers from Cydome discovered that Broadside exploits the command injection vulnerability `CVE-2024-3721` in TBK DVR-4104 and DVR-4216 devices, allowing attackers to hijack these systems. The botnet employs advanced techniques such as a custom C2 protocol, a unique Magic Header, and a process-killer module to maintain persistence and evade detection. In addition to supporting UDP-based DDoS attacks, Broadside is capable of stealing sensitive files like `/etc/passwd` and `/etc/shadow`, enabling privilege escalation and lateral movement within compromised networks. The maritime sector is particularly vulnerable due to widespread use of legacy, unpatched systems and a general lack of onboard cybersecurity personnel or monitoring. The Broadside campaign has been active for months, with fluctuating activity observed by researchers. Attackers leverage a mass loader to execute multi-architecture payloads in memory and wipe traces, making detection and remediation challenging. The ongoing exploitation of `CVE-2024-3721` by Broadside and other botnets highlights the urgent need for improved security practices and patch management in maritime environments to prevent further compromise and disruption.
Jun 29, 2026
Trend Micro disclosed a Mirai variant in May 2019 that combined 13 exploits targeting routers, surveillance devices, and the ThinkPHP framework. Detected as **Backdoor.Linux.MIRAI.VWIPT**, the malware supported backdoor access, distributed denial-of-service attacks, and credential brute forcing. Researchers described it as the first observed Mirai campaign to combine all 13 exploits, although those exploits had appeared in earlier attacks. The variant used three XOR keys to encrypt data, with a command-and-control endpoint at `35[.]235[.]102[.]123:1337` and download and dropper URLs hosted under a `hopto[.]org` domain. The discovery complemented Unit 42 reporting on Mirai and Gafgyt IoT/Linux botnet campaigns, highlighting the continued use of vulnerable connected devices as botnet infrastructure. Trend Micro recommended applying security patches and evaluating manufacturers’ security practices and update consistency before connecting devices to networks. Defenders should prioritize exposed routers and surveillance equipment for vulnerability assessment and remediation, while treating the reported infrastructure as historical indicators rather than evidence of current activity.
Oct 9, 2026
Fortinet and other reporting identified **Nexcorium**, a Mirai-derived malware strain targeting Internet of Things devices, particularly **TBK DVR-4104** and **DVR-4216** video recorder systems used with security cameras. The campaign exploits **`CVE-2024-3721`**, an OS command injection flaw, to run a downloader script that retrieves malware binaries for multiple Linux architectures. Fortinet linked the activity to a suspected actor it calls **Nexus Team**, citing the custom HTTP header `X-Hacked-By: Nexus Team – Exploited By Erratic.` Once installed, Nexcorium uses classic Mirai-style scanner, watchdog, and attack modules, establishes persistence through mechanisms including init, `rc.local`, systemd, and cron, and spreads further through brute-force Telnet activity, default-password abuse, and exploitation of **`CVE-2017-17215`** in Huawei HG532 devices. The malware performs self-checks, replication, and self-deletion to improve resilience and evasion, then connects to the command-and-control domain `r3brqw3d[.]b0ats[.]top` to receive instructions for **DDoS** operations, including UDP, TCP SYN, TCP ACK, SMTP, and VSE query floods.
Jun 29, 2026