New ‘Broadside’ Botnet Poses Risk to Shipping Companies

The security firm Cydome reports a new Mirai-based Broadside botnet that targets TBK Vision DVR devices in a campaign that could threaten the maritime logistics sector. The Broadside malware exploits CVE-2024-3721, an OS command injection flaw found in TBK DVR-4104 and DVR-4216 models, which allows remote arbitrary code execution via crafted HTTP requests.

TBK devices are sold under other names as well, such as CeNova, HVR Login, Night Owl, Novo, Pulnix, QSee, and Securus, and the flaw was publicly disclosed in April 2024 with PoC code available. By mid-2025, multiple botnets had already used the flaw to launch DDoS campaigns, and infections were reported in several countries.

Broadside adds a memory-resident loader that attempts to fetch and run payloads across supported architectures, uses a custom C&C protocol and Netlink sockets for process monitoring, and can harvest credential files to enable lateral movement, while also featuring a process killer module to maintain control. The compromised DVRs on vessels could allow access to CCTV feeds and potentially disrupt ship communications or OT systems.