Security experts recommend immediate action including blocking known malicious IP addresses, applying all available patches, restricting public internet access to DVR interfaces, and implementing comprehensive network monitoring to detect unusual scanning or exploitation attempts. Cybersecurity researchers have identified a significant spike in exploitation attempts targeting TVT NVMS9000 digital video recorders (DVRs), with activity surging to three times normal levels in early April 2025. The exploitation targets an information disclosure vulnerability in TVT surveillance systems that can be leveraged to gain full administrative control over affected devices. GreyNoise researchers noted that the exploitation attempts peaked on April 3, 2025, with over 2,500 unique IP addresses detected targeting these systems. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Once compromised, these systems can be enlisted into the botnet’s network, potentially contributing to distributed denial-of-service (DDoS) attacks and other malicious activities characteristic of Mirai operations. The primary targets of this campaign are systems located in the United States, United Kingdom, and Germany, while the attacking infrastructure predominantly originates from Taiwan, Japan, and South Korea. TVT Digital Technology Co., Ltd., the Shenzhen-based manufacturer of the affected NVMS9000 DVRs, has reportedly served customers in more than 120 countries, indicating the potentially vast scope of vulnerable systems. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Their analysis confirmed substantial overlap with known Mirai activity patterns, strongly suggesting this campaign represents an expansion of the notorious botnet’s infrastructure. Upon discovering vulnerable systems, the attackers exploit the information disclosure vulnerability to extract administrative credentials.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 10 Apr 2025 10:00:15 +0000