cyber.hendryadrian.com
Security News · thehackernews.com

Nexcorium Botnet Exploits TBK DVR Flaw as Attackers Probe EoL TP-Link Routers

· Original article ↗

Summary

Fortinet reports a Mirai variant, Nexcorium, exploiting CVE-2024-3721 in TBK DVRs. Unit 42 observed flawed scans for CVE-2023-33538 against end-of-life TP-Link routers; users are advised to replace unsupported devices and avoid default credentials.

Key points

  • Fortinet reports Nexcorium exploiting command injection vulnerability CVE-2024-3721 in TBK DVR-4104 and DVR-4216 devices to deliver a botnet payload.
  • Nexcorium supports multiple architectures and includes XOR-encoded configuration, watchdog, and DDoS modules.
  • The malware uses CVE-2017-17215 against Huawei HG532 devices and hard-coded credentials to attempt Telnet brute-force access.
  • After successful Telnet access, Nexcorium can establish persistence through crontab and systemd, then receive commands for UDP, TCP, and SMTP DDoS attacks.
  • Unit 42 observed automated scans targeting CVE-2023-33538 in end-of-life TP-Link routers; the observed approach was flawed and did not result in successful compromise.
  • The TP-Link vulnerability affects TL-WR940N, TL-WR740N, and TL-WR841N models; researchers say successful exploitation requires authentication to the router's web interface.
  • Users of unsupported affected TP-Link routers are advised to replace them and avoid default credentials.

Article Details

Event Type
Reported exploitation of TBK DVR vulnerability to deploy the Nexcorium Mirai variant, alongside automated scans targeting end-of-life TP-Link routers.
Impact
Fortinet reported that exploiting CVE-2024-3721 can deliver Nexcorium to TBK DVRs. The malware can establish persistence, spread through Telnet brute-force attempts, and launch DDoS attacks. Unit 42 observed scans targeting CVE-2023-33538, but said the observed attempts used a flawed approach and did not successfully compromise routers.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationNexcorium uses XOR-encoded configuration data.T1053.003 · CronNexcorium uses crontab to establish persistence.T1059.004 · Unix ShellAfter a successful Telnet login, the malware attempts to obtain a shell.T1070.004 · File DeletionAfter establishing persistence, the malware deletes the originally downloaded binary to evade analysis.T1105 · Ingress Tool TransferA downloader script obtains and drops the botnet payload.T1110.001 · Password GuessingNexcorium uses hard-coded credentials in Telnet brute-force attempts against hosts.T1190 · Exploit Public-Facing ApplicationReported exploitation of vulnerabilities in TBK DVRs and Huawei HG532 devices to gain access.T1498 · Network Denial of ServiceNexcorium can launch DDoS attacks over UDP, TCP, and SMTP.T1543.002 · Systemd ServiceNexcorium uses a systemd service to establish persistence.

CVE

CVE-2017-17215Huawei Technologies Co., Ltd. · HG532The malware exploits CVE-2017-17215 against Huawei HG532 devices and uses hard-coded credentials for Telnet brute-force.CVE-2023-33538Tp-link · Tl-wr740n firmware; Tp-link · Tl-wr841n firmware; +1 moreuse brute-force Telnet and other exploits for lateral movement and persistence, and scans targeting CVE-2023-33538 have been observed against unsupported TP-Link models.CVE-2024-3721TBK · DVR-4104; TBK · DVR-4216; +2 moreThe campaigns leverage CVE-2024-3721 to deliver downloaders, use brute-force Telnet and other exploits for lateral movement and persistence, and scans targeting CVE-2023-33538 have been observed against unsupported

People

Asher DavilaUnit 42 researcher who reported on scans targeting CVE-2023-33538 and the authentication required for successful exploitation.Chris NavarreteUnit 42 researcher who reported on scans targeting CVE-2023-33538 and the authentication required for successful exploitation.Malav VyasUnit 42 researcher who reported on scans targeting CVE-2023-33538 and the authentication required for successful exploitation.Vincent LiQuoted as a security researcher discussing IoT devices as targets and the risks of exploiting known vulnerabilities to deploy persistent malware.

Malware

Mirai42 report threat actors exploiting vulnerabilities in TBK DVRs and end-of-life TP-Link routers to deploy Mirai-like botnets, including a Nexcorium variant.Mortedetails of a large-scale loader-as-a-service botnet that has been distributing RondoDox, Mirai, and Morte payloads through weak credentials and old flaws in routers, IoT devices, and enterprise apps.Nexcoriumvulnerabilities in TBK DVRs and end-of-life TP-Link routers to deploy Mirai-like botnets, including a Nexcorium variant.RondoDoxOver the past year, the security issue has been leveraged to deploy a Mirai variant as well as a distinct, relatively new botnet called RondoDox.

Vendors

HuaweiThe malware exploits CVE-2017-17215 against Huawei HG532 devices and uses hard-coded credentials for Telnet brute-force.TBKFortinet FortiGuard Labs and Palo Alto Networks Unit 42 report threat actors exploiting vulnerabilities in TBK DVRs and end-of-life TP-Link routers to deploy Mirai-like botnets, including a Nexcorium variant.TP-LinkPalo Alto Networks Unit 42 report threat actors exploiting vulnerabilities in TBK DVRs and end-of-life TP-Link routers to deploy Mirai-like botnets, including a Nexcorium variant.

Products

Huawei Home Gateway HG532The malware exploits CVE-2017-17215 against Huawei HG532 devices and uses hard-coded credentials for Telnet brute-force.TBK DVR-4104exploit CVE-2024-3721 (CVSS score: 6.3), a medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 digital video recording devices, to deliver a Mirai variant called Nexcorium.TL-WR740N v1TL-WR740N v1 and v2TL-WR841N v8TL-WR841N v8 and v10TL-WR940N v2TL-WR940N v2 and v4

Related Articles