FortiGuard Details Nexcorium IoT Botnet Campaign Exploiting TBK DVR Flaw
Summary
FortiGuard Labs analyzes a campaign exploiting CVE-2024-3721 in TBK DVR devices to install Nexcorium, a Mirai variant with multiple persistence methods, brute-force capabilities and DDoS functions. A link to “Nexus Team” is suspected.
Key points
- Attackers exploited the OS command injection flaw CVE-2024-3721 in TBK DVR-4104 and DVR-4216 devices to deliver a downloader.
- The downloader fetched Nexcorium builds for ARM, MIPS R3000 and x86-64 systems.
- Nexcorium uses watchdog, scanner and attacker modules; it includes a hard-coded credential list, Telnet brute-force behavior and an exploit for CVE-2017-17215.
- The malware persists through /etc/inittab, /etc/rc.local, a systemd service, crontab and a copy at /usr/local/bin/sysd.
- It supports multiple DDoS modes and connects to r3brqw3d[.]b0ats[.]top for commands.
- A custom X-Hacked-By header suggests a possible link to the suspected “Nexus Team”; FortiGuard says its products detect or block the described malware and infrastructure.
Article Details
- Attack Vectors
- Attackers exploited CVE-2024-3721, an OS command injection vulnerability in TBK DVR devices, by manipulating the mdb / mdc arguments to deliver a downloader script.
- The downloader fetched Nexcorium samples for ARM, MIPS R3000, and x86-64 Linux systems.
- Nexcorium scanned hosts and attempted Telnet logins using a hard-coded username and password list.
- Nexcorium included an exploit for CVE-2017-17215 targeting Huawei HG532 devices.
- The botnet used C2-issued commands to launch UDP, TCP, SMTP, and VSE query flood attacks.
- Defensive Notes
- FortiGuard Labs recommends monitoring for malicious traffic and behavior patterns associated with vulnerability exploitation and IoT botnet activity.
- The article reports FortiGuard Antivirus detections, FortiGuard Web Filtering blocking the C2 server, and an IPS signature for CVE-2024-3721.
- The article states that customers using Fortinet products with up-to-date signatures are protected against the described malware components.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | r3brqw3d[.]b0ats[.]top | C2 domain that Nexcorium connects to for commands. |
| IPV4 | 176[.]65[.]148[.]186 | Listed among campaign hosts as C2/infrastructure or observed hosts; the article does not specify its individual role. |
| IPV4 | 84[.]200[.]87[.]36 | Listed among campaign hosts as C2/infrastructure or observed hosts; the article does not specify its individual role. |
| SHA256 | 0b510f93f47590791626d2fa74ddd62ba6eb8a5a5bb7b8476c0ceffc7be94ebe | Hash listed for a Nexcorium malware sample. |
| SHA256 | 29404df12a7723ce46c8b199c88a808aa315dd8ff8fd1e06a34ccd3d16f4553b | Hash listed for a Nexcorium malware sample. |
| SHA256 | 2ccf23b8165e8c05899aa7ba4755b896ebf1d20d3b701cffdc768482486b0a74 | Hash listed for a Nexcorium malware sample. |
| SHA256 | 37132e804ccb3fc4ba1f72205da70c3d7a6e66b43178707a9d8ee1156d815c21 | Hash listed for a Nexcorium malware sample. |
| SHA256 | 696aeb6321313919f0a41a520e6fa715450bbfb271a9add1e54efe16484a9c35 | Hash listed for the malicious downloader. |
| SHA256 | 721c7cb2109ec97c14413cb8b58ddce0ecf0c1f13f22ee4f72eed79b57592cf5 | Hash listed for a Nexcorium malware sample. |
| SHA256 | 7c01d5b53861cd34e10a79fdea16dcf08bce9c78ed72abd6d6f3e9ce75a24734 | Hash listed for a Nexcorium malware sample. |
| SHA256 | 838e35b62a6b38675e467301166cdcc54f98d528fe43d56936caeffec88ac696 | Hash listed for a Nexcorium malware sample. |
| SHA256 | 89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400 | Hash listed for a Nexcorium malware sample. |
| SHA256 | 95d1eb12d58206319c514c7240d058c512bb22b31f6ea22ed8be3ae44305c9f7 | Hash listed for a Nexcorium malware sample. |
| SHA256 | 9b805585c457811d2c5c5664ede9ee869b53e3c9999100505d7ee8de7f855fdf | Hash listed for a Nexcorium malware sample. |
| SHA256 | b1274de00a7f3d7ab9792ec3456e9d5bf057738666f34183f1d72060e2d4f678 | Hash listed for a Nexcorium malware sample. |
| SHA256 | e4789416c35b345e75c023a8c07c207c79937c6a5444e1c29d85d18d2f660d8c | Hash listed for a Nexcorium malware sample. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolNexcorium opened Telnet connections to scanned hosts and attempted credential-based logins.T1027 · Obfuscated Files or InformationNexcorium used XOR encoding for configuration data and embedded exploit material.T1036 · MasqueradingNexcorium copied itself to /usr/local/bin/sysd, a name and path used for persistence.T1037.004 · RC ScriptsNexcorium modified /etc/rc.local and /etc/inittab to maintain execution across startup or process termination.T1053.003 · CronNexcorium created a crontab task to run again after reboot.T1059.004 · Unix ShellThe delivered downloader script and Nexcorium executed shell commands on compromised Linux devices.T1070.004 · File DeletionAfter establishing persistence, Nexcorium deleted its original binary from the current execution path.T1082 · System Information DiscoveryNexcorium parsed victim architecture information to select appropriate payloads and behavior.T1105 · Ingress Tool TransferThe dvr downloader fetched Nexcorium samples from remote infrastructure.T1110 · Brute ForceNexcorium used a hard-coded credential list to brute-force Telnet logins.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2024-3721 in exposed TBK DVR devices to gain access and deliver a downloader.T1498 · Network Denial of ServiceNexcorium supported UDP, TCP, SMTP, and VSE query flood attacks.T1543.002 · Systemd ServiceNexcorium created /etc/systemd/system/persist.service to run at startup.
CVE
CVE-2017-17215Huawei Technologies Co., Ltd. · HG532The malware includes brute-force credentials, Telnet-based scanning/login behavior, and an exploit for CVE-2017-17215 targeting Huawei HG532 devices.CVE-2024-3721TBK · DVR-4104; TBK · DVR-4216; +2 moreFortiGuard Labs analyzed a campaign exploiting CVE-2024-3721 in TBK DVR-4104 and DVR-4216 devices to install the multi-architecture Mirai variant Nexcorium, which uses downloader scripts, persistence tricks, brute-force
Threat Actors
Malware
Miraicampaign exploiting CVE-2024-3721 in TBK DVR-4104 and DVR-4216 devices to install the multi-architecture Mirai variant Nexcorium, which uses downloader scripts, persistence tricks, brute-force login attempts, and DDoSNexcoriumCVE-2024-3721 in TBK DVR-4104 and DVR-4216 devices to install the multi-architecture Mirai variant Nexcorium, which uses downloader scripts, persistence tricks, brute-force login attempts, and DDoS modules.
Vendors
HuaweiThe malware includes brute-force credentials, Telnet-based scanning/login behavior, and an exploit for CVE-2017-17215 targeting Huawei HG532 devices.TBKFortiGuard Labs analyzed a campaign exploiting CVE-2024-3721 in TBK DVR-4104 and DVR-4216 devices to install the multi-architecture Mirai variant Nexcorium, which uses downloader scripts, persistence tricks, brute-force
Products
Huawei Home Gateway HG532The malware includes brute-force credentials, Telnet-based scanning/login behavior, and an exploit for CVE-2017-17215 targeting Huawei HG532 devices.TBK DVR-4104FortiGuard Labs analyzed a campaign exploiting CVE-2024-3721 in TBK DVR-4104 and DVR-4216 devices to install the multi-architecture Mirai variant Nexcorium, which uses downloader scripts, persistence tricks, brute-force