New Mirai botnet behind rise in TVT DVR exploit

A significant increase in exploitation attempts targeting TVT NVMS9000 DVRsappears to be due to the new Mirai botnet, peaking on April 3, 2025, with over 2,500 unique IP addresses scanning for vulnerable devices.

See also: Ballista botnet targets TP-Link Archer routers

These attacks attempt to exploit an information disclosure vulnerability, first disclosed by an SSD advisory in May 2024, which published details of a full exploit to obtain administrator credentials in clear text using a single TCP payload . This exploit bypasses authentication, allowing attackers to execute administrative commands on the device without restrictions.

According to threat monitoring platform GreyNoise, which detected the TVT DVR exploitation activity, it is likely related to Mirai-based malware that seeks to integrate its devices into a botnet. Typically, infected devices are used to cause malicious traffic, mine cryptocurrency, or perform distributed denial-of-service (DDoS) attacks.

In the last month, GreyNoise has recorded 6,600 different IP addresses associated with this activity, all confirmed as malicious and non-spoofable. Most attacks originate from Taiwan, Japan, and South Korea, while the majority of targeted devices are located in the U.S., U.K., and Germany.

The TVT NVMS9000 digital video recorder is a product of TVT Digital Technology Co., Ltd. , based in Shenzhen. These recorders are mainly used in security and surveillance systems to record, store and manage video from security cameras.

See also: Eleven11bot botnet has infected 86,000 devices for DDoS attacks

Since these recorders are usually connected to the internet, they have been targeted by various botnets, some of which even exploit old vulnerabilities dating back five years. Recent examples of botnets targeting exposed recorders include HiatusRAT, Mirai , and FreakOut.

According to SSD's warning, customers should upgrade to firmware version 1.3.4 or later to fix the vulnerability. If upgrading is not possible, it is recommended to restrict public internet access for DVR ports and block incoming requests from IP addresses reported by GreyNoise.

Signs of infection by Mirai on a DVR include increased traffic output, slow performance, frequent crashes or reboots, high CPU/memory usage even when idle, and altered settings. If any of these signs are observed, disconnect the DVR, perform a factory reset, upgrade to the latest firmware version, and then isolate it from the main network.

See also: Vo1d malware botnet targets more and more Android TVs

A botnet (from the words “robot” and “network”) is a network of computers or devices that have been infected with malware and are controlled remotely by an attacker (known as a “botmaster” or “herder”). These computers, called “bots” or “zombies,” are often unaware that they have been infected and are unable to control their activity. To protect against botnets, it is important to keep your computer software up to date, have a reliable antivirus , and avoid suspicious files or links from unknown sources.

Source: bleepingcomputer