- Greynoise says scanning for vulnerable TVT DVR’s Spider
- More than 2,500 unique IP addresses hunted at one point
- A vulnerability from 2024 allows threat actors to run admin -commands on the device
Operators of Mirai Botnet are actively chasing after vulnerable TVT -DVRs to assimilate them in the dishonest network, CyberSecurity scientists Greynoise have revealed after observing an increase in exploitation attempts.
In May 2024, security researchers from SSD Secure Disclosure reported a vulnerability affecting NVMS9000 DVRs built by the Shenzhen-based TV Digital Technology Manufacturer. The vulnerability was described as an approval city pass, enabling threat actors to run admin commands on the device that is unabated.
All versions before 1.3.4 were said to be affected, but a patch was released and versions 1.3.4 and newer were no longer vulnerable.
“No malicious files hosted”
Users who do not keep track of updates and do not patch their systems on time are now at risk. Greynoise said the attack on April 3 topped, with more than 2,500 unique IP addresses scanning according to vulnerable final points. We do not know how many of these DVRs there are or how large the attack surface can be.
The researchers said that malware implemented on the DVRs is tied to Mirai, one of the most notorious botnets in cyber security history. Mirai is usually targeted at smart devices, Internet of Things (IoT) devices and Internet -connected hardware and used to run disturbing distributed denial of service (DDOS) attacks.
Greynoise said that in the last 30 days it logged 6,600 unique IP addresses associated with this activity. All the addresses were confirmed to be malicious. They mostly came from Taiwan, Japan and South Korea that targeted units in the US, UK and Germany.
Mirai operators are quite active this year. In mid-January, news of the targeted industrial routers vulnerable to a zero day. A few weeks later, Akamai security researchers said they caught a new variant of botnet targeting of business telephone units built by Mitel.
Via Bleeping computer
