‘Broadside’ Mirai Variant Targets Maritime Logistics Sector

“Broadside” is targeting a critical flaw in DVR systems to conduct remote command injection, which can hijack devices to achieve persistence and move laterally, researchers say. The variant specifically targets TBK DVR devices for remote command injection via CVE-2024-3721 on the /device[.]rsp endpoint, then proceeds with high-rate UDP flooding and Netlink-based process monitoring for stealthy persistence.

Researchers at Cydome's Cybersecurity Research Team identified the variant, which they’ve dubbed "Broadside," about 10 days ago while monitoring marine assets, according to a blog post published today, and found that the attack has been active for months. The flaw allows attackers to hijack DVR-4104 and DVR-4216 devices, which are widely used in the maritime industry, and may enable the attackers to harvest system credential files and move laterally.

The campaign remains active, with C2 communications using a custom protocol over TCP/1026 and fallback over TCP/6969, and operators can mitigate by updating patched systems, applying IoCs, and enforcing network segmentation.