CyberSecurity news

FlagThis - #miraibotnet

Mike Moore@techradar.com //
A new wave of cyberattacks is targeting Internet of Things (IoT) devices through both the Mirai botnet and BadBox 2.0 malware. Cybersecurity researchers have discovered a new variant of the Mirai botnet that exploits a critical vulnerability, CVE-2024-3721, in TBK DVR devices. This vulnerability allows attackers to remotely deploy malicious code on digital video recording systems commonly used for surveillance. Kaspersky GReAT experts have described the new features of this Mirai variant, noting that the latest botnet infections specifically target TBK DVR devices.

Simultaneously, the FBI has issued a warning about the dangerous BadBox 2.0 malware, which has already infected over a million devices, including smart TVs, streaming boxes, digital projectors, and tablets. These devices, often cheap, off-brand, Android-powered units, are being hijacked to form a global botnet used for malicious activities such as ad fraud, click fraud, and distributed denial-of-service (DDoS) attacks. The compromised devices are turned into residential proxies, which are then sold or provided for free to cybercriminals, enabling a wide range of illicit activities.

The Mirai botnet leverages a vulnerability in TBK DVR devices, enabling unauthorized system command execution. Attackers send targeted POST requests to vulnerable endpoints, containing encoded shell commands to download and execute ARM32 binary payloads. This streamlined approach allows for efficient infection, bypassing traditional reconnaissance phases. Meanwhile, BadBox 2.0 often comes preloaded on devices or is transferred through malicious firmware updates and Android applications. Once infected, devices become part of a botnet that cybercriminals exploit for various nefarious purposes, highlighting the persistent threat IoT devices pose to cybersecurity.

Share: bluesky twitterx--v2 facebook--v1 threads


References :
  • cyberpress.org: New Mirai Botnet Variant Exploits TBK DVR Vulnerability to Deploy Malicious Code
  • The Record: TV streaming devices, digital projectors and other IoT devices are being infected with BadBox 2.0 malware after the original campaign was stifled by German law enforcement.
  • Securelist: Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721
  • cyberinsider.com: New Mirai Botnet Variant Targets Flaw in 50,000 Exposed TBK DVRs
  • therecord.media: TV streaming devices, digital projectors and other IoT devices are being infected with BadBox 2.0 malware after the original campaign was stifled by German law enforcement.
  • Cyber Security News: Cybersecurity researchers have discovered a new variant of the notorious Mirai botnet that exploits a critical vulnerability in TBK DVR devices to deploy malicious code remotely.
  • gbhackers.com: New Mirai Variant Exploits TBK DVR Flaw for Remote Code Execution
  • securityonline.info: New Mirai Botnet Variant Targets DVR Systems via CVE-2024-3721
  • securityonline.info: New Mirai Botnet Variant Targets DVR Systems via CVE-2024-3721
  • gbhackers.com: New Mirai Variant Exploits TBK DVR Flaw for Remote Code Execution
  • www.bleepingcomputer.com: A new variant of the Mirai malware botnet is exploiting a command injection vulnerability in TBK DVR-4104 and DVR-4216 digital video recording devices to hijack them.
  • CyberInsider: New Mirai Botnet Variant Targets Flaw in 50,000 Exposed TBK DVRs
  • securityaffairs.com: BadBox 2.0 botnet infects millions of IoT devices worldwide, FBI warns
  • securityaffairs.com: New Mirai botnet targets TBK DVRs by exploiting CVE-2024-3721
Classification:
@cyberalerts.io //
Cybersecurity researchers have confirmed that the Samsung MagicINFO 9 Server is under active exploitation, with hackers leveraging a remote code execution (RCE) vulnerability, CVE-2024-7399, to deploy the Mirai botnet. This vulnerability, a path traversal flaw, allows attackers to write arbitrary files as system authority, ultimately leading to remote code execution. The unauthenticated nature of the flaw exacerbates the risk, allowing threat actors to exploit systems without requiring any user credentials. The attacks target the file upload functionality in the MagicINFO 9 Server, intended for updating display content, but is being abused to upload malicious code and execute a shell script responsible for downloading the botnet.

The exploitation of CVE-2024-7399 began shortly after a proof-of-concept (PoC) exploit was made public. Arctic Wolf researchers have observed this exploitation in the wild, noting that the vulnerability allows for arbitrary file writing by unauthenticated users. This improper sanitation of filename input, without validating the file extension or checking for authentication, allows threat actors to upload JSP files and execute arbitrary code with system authority on vulnerable servers. While Samsung released a patch for this vulnerability in August 2024, many systems remain unpatched, leaving them vulnerable to these attacks.

The exploitation of the Samsung MagicINFO flaw is not an isolated incident; threat actors are also targeting GeoVision end-of-life (EoL) Internet of Things (IoT) devices to incorporate them into the Mirai botnet for conducting distributed denial-of-service (DDoS) attacks. Given the low barrier to exploitation, the availability of a public PoC, and the potential for widespread impact, organizations are strongly advised to update their Samsung MagicINFO Server instances to version 21.1050 and later, and implement the patch for CVE-2024-7399 immediately to mitigate potential operational impact.

Share: bluesky twitterx--v2 facebook--v1 threads


References :
  • Arctic Wolf: Arctic Wolf Observes Exploitation of Path Traversal Vulnerability in Samsung MagicINFO 9 Server (CVE-2024-7399)
  • arcticwolf.com: Arctic Wolf Observes Exploitation of Path Traversal Vulnerability in Samsung MagicINFO 9 Server (CVE-2024-7399)
  • cyberinsider.com: Samsung MagicINFO Flaw Now Actively Exploited by Mirai Botnet
  • thehackernews.com: Hackers Exploit Samsung MagicINFO, GeoVision IoT Flaws to Deploy Mirai Botnet
  • www.bleepingcomputer.com: Samsung MagicINFO 9 Server RCE flaw now exploited in attacks
  • arcticwolf.com: Arctic Wolf Observes Exploitation of Path Traversal Vulnerability in Samsung MagicINFO 9 Server (CVE-2024-7399)
  • securityaffairs.com: Samsung MagicINFO flaw exploited days after PoC exploit publication
  • The Hacker News: Hackers Exploit Samsung MagicINFO, GeoVision IoT Flaws to Deploy Mirai Botnet
  • www.helpnetsecurity.com: Exploited: Vulnerability in software for managing Samsung digital displays (CVE-2024-7399)
  • BleepingComputer: Hackers are exploiting an unauthenticated remote code execution (RCE) vulnerability in the Samsung MagicINFO 9 Server to hijack devices and deploy malware.
  • CyberInsider: Samsung MagicINFO Flaw Now Actively Exploited by Mirai Botnet
  • Help Net Security: Exploited: Vulnerability in software for managing Samsung digital displays (CVE-2024-7399)
  • Arctic Wolf: Arctic Wolf Observes Exploitation of Path Traversal Vulnerability in Samsung MagicINFO 9 Server (CVE-2024-7399)
  • bsky.app: A Mirai botnet is exploiting a 2024 bug in MagicINFO, a Samsung digital signage system
  • BleepingComputer: Hackers are exploiting an unauthenticated remote code execution (RCE) vulnerability in the Samsung MagicINFO 9 Server to hijack devices and deploy malware. [...]
  • The DefendOps Diaries: Understanding and Mitigating the CVE-2024-7399 Vulnerability in Samsung MagicINFO 9 Server
  • The Hacker News: Hackers Exploit Samsung MagicINFO, GeoVision IoT Flaws to Deploy Mirai Botnet
  • www.techradar.com: Top Samsung software hit by attackers to spread malware and hijack devices
Classification:
  • HashTags: #RCE #IoT #MiraiBotnet
  • Company: Samsung
  • Target: Samsung MagicINFO 9 Servers
  • Product: MagicINFO 9 Server
  • Feature: Remote Code Execution
  • Malware: Mirai
  • Type: Vulnerability
  • Severity: Critical
@securityonline.info //
GreyNoise has observed a significant surge, approximately three times the typical level, in exploitation attempts targeting TVT NVMS9000 DVRs. The peak of this activity occurred on April 3, 2025, with over 2,500 unique IP addresses involved in scanning for vulnerable devices. This vulnerability is an information disclosure flaw that allows attackers to gain administrative control over affected systems, essentially bypassing authentication and executing commands without restriction. Countless prior reports have identified the TVT NVMS9000 DVR as a target for botnet recruitment, including a GreyNoise update in early March 2025.

The exploitation activity is strongly suspected to be associated with the Mirai botnet, a notorious threat known for targeting vulnerabilities in IoT devices. GreyNoise has identified sufficient overlap with Mirai to support this attribution. Manufactured by TVT Digital Technology Co., Ltd., based in Shenzhen, the NVMS9000 DVRs are used in security and surveillance systems for recording, storing, and managing video footage from security cameras. The company reports serving customers in over 120 countries.

The majority of the malicious IP addresses involved in the exploitation attempts originate from the Asia-Pacific (APAC) region, specifically Taiwan, Japan, and South Korea. However, the top target countries are the United States, United Kingdom, and Germany. Organizations using the NVMS9000 DVR or similar systems are advised to take immediate action to secure their devices. Recommended mitigations include blocking known malicious IP addresses, applying all available patches, restricting public internet access to DVR interfaces, and closely monitoring network traffic for signs of unusual scanning or exploitation attempts.

Share: bluesky twitterx--v2 facebook--v1 threads


References :
  • The GreyNoise Blog: GreyNoise Observes 3X Surge in Exploitation Attempts Against TVT DVRs — Likely Mirai
  • bsky.app: New Mirai botnet behind surge in TVT DVR exploitation
  • BleepingComputer: New Mirai botnet behind surge in TVT DVR exploitation
  • securityonline.info: TVT DVRs Under Siege: Massive Exploitation Attempts Expose Critical Flaw
  • The DefendOps Diaries: Explore the resurgence of the Mirai botnet, its global impact, and advanced exploitation techniques targeting IoT devices.
  • Cyber Security News: GreyNoise has detected a significant rise in exploitation attempts targeting TVT NVMS9000 DVRs, a line of digital video recorders primarily used in security and surveillance systems.
  • www.scworld.com: Deluge of TVT DVR exploitation attempts likely due to Mirai-based botnet
  • bsky.app: A significant spike in exploitation attempts targeting TVT NVMS9000 DVRs has been detected, peaking on April 3, 2025, with over 2,500 unique IPs scanning for vulnerable devices.
  • cyberpress.org: Mirai Botnet Variant Targets TVT DVRs to Seize Administrative Control
Classification: