Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new wave of Mirai botnet attacks is exploiting CVE-2024-3721 to target TBK DVR devices. The campaign uses a POST request to execute system commands without authorization, downloading and running an ARM32 binary. This Mirai variant includes features like RC4 string encryption, anti-VM checks, and anti-emulation techniques. The malware verifies if it's running in a virtual environment and checks for allowed directories. Infected devices are primarily located in China, India, Egypt, Ukraine, Russia, Turkey, and Brazil. Over 50,000 exposed DVR devices are potentially vulnerable. The botnet's main goal is to conduct DDoS attacks. Updating vulnerable devices and performing factory resets are recommended as protective measures.

The threat described involves a new wave of attacks by a Mirai botnet variant exploiting a recently disclosed vulnerability identified as CVE-2024-3721. This vulnerability affects TBK brand Digital Video Recorder (DVR) devices, which are commonly used in surveillance and security camera systems. The exploitation method involves sending a specially crafted POST request that allows unauthenticated attackers to execute arbitrary system commands on the targeted device. Upon successful exploitation, the attacker downloads and executes an ARM32 binary payload, which is a variant of the Mirai malware. This variant incorporates advanced evasion techniques such as RC4 string encryption to obfuscate its code and communications, anti-virtual machine (VM) checks, and anti-emulation methods to avoid detection and analysis in sandboxed or virtualized environments. The malware also verifies that it is running in allowed directories before proceeding, which further complicates forensic analysis and detection. The primary objective of this botnet is to conscript vulnerable DVR devices into a large-scale distributed denial-of-service (DDoS) botnet, leveraging their network connectivity and processing power to overwhelm targeted systems or networks. The campaign has identified over 50,000 exposed TBK DVR devices as potentially vulnerable, with infections primarily reported in countries including China, India, Egypt, Ukraine, Russia, Turkey, and Brazil. Although the campaign is currently not reported to have active exploits in the wild beyond initial observations, the scale of vulnerable devices and the sophistication of the malware indicate a significant threat vector. The lack of available patches or firmware updates for these devices exacerbates the risk, making mitigation reliant on device resets and network-level protections. The technical sophistication of the malware, combined with the critical role of DVR devices in security infrastructure, underscores the importance of addressing this vulnerability promptly.

Detailed information about Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721. Get real-time updates, technical details, and mitiga

Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721 - Live Threat Intelligence - Threat Radar | OffSeq.com

Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721

StealC V2, introduced in March 2025, is an enhanced version of the popular information stealer and malware downloader. Key updates include a streamlined JSON-based C2 communication protocol with RC4 encryption, expanded payload delivery options (MSI packages and PowerShell scripts), and a redesigned control panel with an integrated builder. New features comprise multi-monitor screenshot capture, a unified file grabber, and server-side brute-forcing for credentials. The malware now supports customizable payload delivery rules based on geolocation, hardware IDs, and installed software. Technical analysis reveals improvements in obfuscation, API resolution, and configuration encryption. StealC V2 is actively developed and frequently used in conjunction with other malware families like Amadey.

StealC V2 is an advanced iteration of the StealC malware family, first introduced in March 2025. It functions primarily as an information stealer and malware downloader, designed to exfiltrate sensitive data and facilitate further payload delivery. The malware employs a streamlined JSON-based command and control (C2) communication protocol secured with RC4 encryption, enhancing stealth and complicating detection efforts. Notably, StealC V2 expands its payload delivery mechanisms to include MSI installer packages and PowerShell scripts, increasing its flexibility and evasion capabilities. The control panel has been redesigned to integrate a builder, allowing attackers to customize malware builds easily. New technical features include multi-monitor screenshot capture, a unified file grabber capable of extracting diverse data types, and server-side brute forcing to harvest credentials more effectively. The malware supports granular payload delivery rules based on geolocation, hardware identifiers, and installed software, enabling targeted attacks and reducing exposure. Technical improvements also encompass enhanced obfuscation techniques, dynamic API resolution to evade static analysis, and encrypted configuration storage. StealC V2 is actively maintained and often deployed alongside other malware families such as Amadey, indicating its role within a broader threat ecosystem. Despite its sophistication, there are no known public exploits in the wild specifically targeting vulnerabilities, suggesting it relies on social engineering or other infection vectors. The malware’s capabilities align with multiple MITRE ATT&CK techniques, including credential dumping, process injection, and command and control communications, highlighting its multifaceted threat profile.

Detailed information about I StealC You: Tracking the Rapid Changes To Steal. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'rc4 encryption'

Filter Threats

Threats Tagged 'rc4 encryption'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility