Nexcorium TBK DVR Campaign

Mirai variantNexcoriumNexus TeamCVE-2024-3721CVE-2017-17215DDoSIoT botnetpersistence mechanismsbrute-force attacksmulti-architecture malware

A multi-architecture Mirai variant exploiting CVE-2024-3721 in TBK DVR devices to deliver persistent IoT botnet malware. The campaign leverages vulnerability-driven attacks to gain initial access, establish persistence, and launch large-scale DDoS attacks across diverse architectures.

Indicators of Compromise

Domains (1)

r3brqw3d.b0ats.top

Hashes (17)

89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae4007c01d5b53861cd34e10a79fdea16dcf08bce9c78ed72abd6d6f3e9ce75a24734aaed4dca8bd6bb42fc4efb358a02a5542ccf23b8165e8c05899aa7ba4755b896ebf1d20d3b701cffdc768482486b0a740b510f93f47590791626d2fa74ddd62ba6eb8a5a5bb7b8476c0ceffc7be94ebe353874dd1e12a7f67ba4f7ecbcbcb2af29404df12a7723ce46c8b199c88a808aa315dd8ff8fd1e06a34ccd3d16f4553bebdae1b6a28589ecc8d84557f0e83963396291cf98d2ef26e37be7f8e0c9b1b45329a5288c832ea1838e35b62a6b38675e467301166cdcc54f98d528fe43d56936caeffec88ac696e4789416c35b345e75c023a8c07c207c79937c6a5444e1c29d85d18d2f660d8c9b805585c457811d2c5c5664ede9ee869b53e3c9999100505d7ee8de7f855fdf95d1eb12d58206319c514c7240d058c512bb22b31f6ea22ed8be3ae44305c9f7b1274de00a7f3d7ab9792ec3456e9d5bf057738666f34183f1d72060e2d4f678721c7cb2109ec97c14413cb8b58ddce0ecf0c1f13f22ee4f72eed79b57592cf537132e804ccb3fc4ba1f72205da70c3d7a6e66b43178707a9d8ee1156d815c21696aeb6321313919f0a41a520e6fa715450bbfb271a9add1e54efe16484a9c35

IPv4 (2)

84.200.87.36176.65.148.186

CVEs (2)

CVE-2017-17215CVE-2024-3721

Notes

<div style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;">CONCLUSION The Nexus Team demonstrates strategic adaptability by rapidly weaponizing CVE-2024-3721 in TBK DVR devices to deliver the Nexcorium Mirai variant, showcasing their ability to exploit emerging vulnerabilities before widespread patching occurs. Their use of multi-architecture malware and diverse persistence mechanisms indicates a sophisticated approach to maintaining long-term access across global IoT infrastructures. The campaign's impact extends to any organization with vulnerable TBK DVR devices, particularly those in surveillance and network infrastructure sectors where DVRs are critical components. The combination of vulnerability exploitation, brute-force attacks, and DDoS capabilities creates significant operational disruption potential for affected entities. For effective threat hunting, SOCRadar's IOC Radar should be leveraged to investigate these indicators across enterprise environments, identifying potentially compromised systems before they participate in botnet activities. Dark Web Monitoring capabilities become crucial for detecting credential exposures related to default IoT device credentials used in brute-force attacks. Continuous Cyber Threat Intelligence updates on Nexus Team's TTPs will enhance detection accuracy for similar campaigns. Brand Protection services should monitor for phishing domains mimicking TBK DVR support sites, while Attack Surface Management provides visibility into exposed DVR devices across organizational networks.</div><div> </div>

Mitigation

<div style="line-height:1.38;margin-top:14pt;margin-bottom:4pt;">MITIGATION <a href="https://attack.mitre.org/">REF</a></div> <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col><col></colgroup><tbody><tr style="height:23.25pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Technique ID</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Technique Name</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Tactic</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Mitigation ID</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Description</td></tr><tr style="height:42.75pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1055/">T1055</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1055/">Process Injection</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0005/">Defense Evasion / </a><a href="https://attack.mitre.org/tactics/TA0004/">Privilege Escalation</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1040</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Behavior Prevention on Endpoint — Deploy EDR solutions capable of detecting and blocking abnormal cross-process memory write operations such as OpenProcess + WriteProcessMemory + CreateRemoteThread call chains.</td></tr><tr style="height:29.25pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1055/">T1055</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1055/">Process Injection</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0005/">Defense Evasion / Privilege Escalation</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1026</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management — Restrict the use of highly privileged accounts and minimize permissions required to create or manipulate processes across the environment.</td></tr><tr style="height:29.25pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1498/">T1498</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1498/">Network Denial of Service</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0040/">Impact</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1037</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Filter Network Traffic — Use upstream DDoS filtering services, CDN providers, and scrubbing centers to absorb and clean malicious traffic volumes before they saturate network bandwidth.</td></tr><tr style="height:29.25pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1498/">T1498</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1498/">Network Denial of Service</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0040/">Impact</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1035</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Limit Access to Resource Over Network — Apply rate limiting, connection throttling, and ACLs on critical services to reduce the impact of volumetric flood attacks.</td></tr><tr style="height:29.25pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1080/">T1080</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1080/">Taint Shared Content</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0008/">Lateral Movement</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1038</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Execution Prevention — Use application allowlisting to prevent unknown or unsigned executables dropped into shared directories from running on endpoints.</td></tr><tr style="height:42.75pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1080/">T1080</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1080/">Taint Shared Content</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0008/">Lateral Movement</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1022</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Restrict File and Directory Permissions — Enforce least-privilege write access to shared network drives and collaboration folders; prevent users from writing executable content to shared locations.</td></tr><tr style="height:29.25pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/">T1566</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/">Phishing</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Initial Access</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1049</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Antivirus/Antimalware — Enable Advanced Threat Protection (ATP) on email gateways to automatically scan attachments and URLs for malicious payloads before delivery.</td></tr><tr style="height:29.25pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/">T1566</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/">Phishing</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Initial Access</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1017</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">User Training — Conduct regular phishing awareness training and simulations; educate users to identify suspicious emails and report them through defined procedures.</td></tr><tr style="height:29.25pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/">T1566</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/">Phishing</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Initial Access</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1054</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Software Configuration — Disable Office macro execution by default and enforce DMARC, DKIM, and SPF email authentication policies to reduce spoofed sender delivery.</td></tr><tr style="height:42.75pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/">T1059</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/">Command and Scripting Interpreter</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0002/">Execution</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1038</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Execution Prevention — Use application control policies to block unauthorized use of interpreters such as PowerShell, WScript, CScript, and bash for non-administrative user accounts.</td></tr><tr style="height:42.75pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/">T1059</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/">Command and Scripting Interpreter</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0002/">Execution</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1026</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management — Restrict script interpreter access to authorized administrator accounts only; prevent standard users from invoking execution environments.</td></tr><tr style="height:42.75pt;"><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/">T1059</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/">Command and Scripting Interpreter</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0002/">Execution</a></td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">M1042</td><td style="vertical-align:top;background-color:#efefef;padding:7pt 9pt 7pt 9pt;overflow:hidden;overflow-wrap:break-word;">Disable or Remove Feature or Program — Fully disable unused scripting environments such as VBScript and WScript on endpoints where they serve no operational purpose.</td></tr></tbody></table></div>