Mirai Botnet Variant Exploits DVR Flaw to Build Swarm

A Mirai botnet malware variant is targeting a command injection vulnerability in internet-connected digital video recorders used for CCTV surveillance, enabling attackers to take control of the devices and add them to a botnet.

See Also: Cracking the Code: Securing Machine Identities

Researchers at Russian cybersecurity firm Kaspersky identified an exploit of CVE-2024-3721 while analyzing logs from their Linux honeypot system. The flaw is a command injection vulnerability in internet-connected digital video recorders used for CCTV surveillance. Further investigation confirmed that the activity was linked to a variant of the Mirai botnet, which is abusing this flaw in TBK-manufactured DVR devices to compromise and control them.

Security researcher “netsecfish” first identified the vulnerability in April 2024. The researcher published a proof-of-concept demonstrating how a crafted post request to a specific endpoint could trigger shell command execution by manipulating parameters such as mdb and mdc. Kaspersky confirmed that this exact technique is being used in the wild, with its Linux honeypots capturing active exploitation attempts tied to a Mirai botnet variant deploying netsecfish’s PoC to compromise vulnerable DVR systems.

An anonymous source posted Mirai source code online nearly 10 years ago. It continues to serve as the backbone for many evolving botnet campaigns. The variant targeting DVR systems builds on Mirai’s original framework but incorporates additional capabilities, including RC4-based string obfuscation, checks to evade virtual machine environments and anti-emulation measures.

The attackers use the exploit to deliver a malicious ARM32 binary onto the targeted device, which connects to a command-and-control server to become part of the botnet. The compromised device can be used for distributed denial-of-service attacks, relaying malicious traffic and carrying out other malicious activities.

This Mirai variant employs a basic RC4 algorithm to decrypt its internal strings, with the decryption key itself obfuscated using XOR. After decryption, the strings are stored in a global list for use during runtime. To avoid analysis, the malware also performs anti-virtualization and anti-emulation checks by inspecting active processes for indicators of environments like VMware or QEMU.

Netsecfish reported around 114,000 DVR devices vulnerable to CVE-2024-3721 last year. Kaspersky estimate the number to be closer to 50,000. Most of the infections linked to this Mirai variant are observed in China, India, Egypt, Ukraine, Russia, Turkey and Brazil.