Broadside botnet hits TBK DVRs, raising alarms for maritime logistics

Mirai-based Broadside is targeting the maritime logistics sector by exploiting the command injection vulnerability CVE-2024-3721 in TBK DVR devices used on vessels. According to Cydome’s Cybersecurity Research Team, the campaign identifies an active Broadside variant with a custom C2 protocol, a unique Magic Header and an exclusivity module, and it uses Netlink kernel sockets for stealthy monitoring while payloads are designed to be polymorphic.

The botnet employs a mass loader to execute multi-architecture payloads in memory and wipes traces, and, like other Mirai variants, it can carry out UDP-based DDoS attacks while also harvesting /etc/passwd and /etc/shadow to enable privilege escalation and lateral movement. The TBK DVR flaw also affects rebranded models sold as CeNova, Night Owl, QSee and others, expanding the potential footprint.

In June, Kaspersky found another Mirai variant exploiting CVE-2024-3721 in TBK DVR-4104 and DVR-4216, with most infections seen in China, India, Egypt, Ukraine, Russia, Turkey and Brazil, and more than 50,000 exposed DVRs identified as potential targets.