A significant spike in exploitation attempts targeting TVT NVMS9000 DVRs has been detected, peaking on April 3, 2025, with over 2,500 unique IPs scanning for vulnerable devices. The attacks attempt to exploit an information disclosure vulnerability first disclosed by an SSD Advisory in May 2024, which published the full exploitation details on retrieving admin credentials in cleartext using a single TCP payload. According to the threat monitoring platform GreyNoise, which detected the exploitation activity, it's likely tied to a Mirai-based malware that seeks to incorporate the devices into its botnet. Signs of Mirai infections on DVRs include outbound traffic spikes, sluggish performance, frequent crashes or reboots, high CPU/memory usage even when idle, and altered configurations. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. Typically, infected devices are then used to proxy malicious traffic, cryptomining, or launch distributed denial of service (DDoS) attacks. Most of the attacks originate from Taiwan, Japan, and South Korea, while the majority of the targeted devices are based in the U.S., the U.K., and Germany. As DVRs are commonly internet-connected, they have been historically targeted by various botnets, with some even leveraging five-year-old flaws. Some recent examples of botnets targeting exposed DVRs include HiatusRAT, Mirai, and FreakOut. These DVRs are used primarily in security and surveillance systems to record, store, and manage video footage from security cameras. If upgrading is impossible, it is recommended that public internet access to DVR ports be restricted and that incoming requests from the IP addresses listed by GreyNoise be blocked. Based on an analysis of 14M malicious actions, discover the top 10 MITRE ATT&CK techniques behind 93% of attacks and how to defend against them.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 08 Apr 2025 15:35:15 +0000