Broadside
Broadside is a Mirai-based botnet variant identified by Cydome that is active in the wild and targets vulnerable TBK Vision digital video recorder (DVR) devices, particularly those used in the maritime logistics sector and on vessels. It exploits CVE-2024-3721, a critical unauthenticated OS command injection vulnerability affecting TBK DVR-4104 and DVR-4216 devices via crafted HTTP POST requests to the /device.rsp endpoint. The affected products are also sold under rebranded names including CeNova, HVR Login, Night Owl, Novo, Pulnix, QSee, and Securus.
According to the provided reporting, Broadside uses a mass loader to execute multi-architecture payloads directly in memory and remove disk artifacts to evade detection. It supports DDoS activity, including UDP flooding, and uses payload polymorphism to hinder static defenses. The malware employs a custom command-and-control protocol, with reporting indicating communications over TCP/1026 and fallback on TCP/6969, and is described as using a unique Magic Header signature. Broadside also uses Netlink kernel sockets for stealthy, event-driven process monitoring and persistence.
Broadside includes a process-killer or exclusivity component described as a "Judge, Jury, and Executioner" module that terminates competing or hostile processes and maintains exclusive control of infected hosts. It attempts to harvest /etc/passwd and /etc/shadow, which researchers assessed could support foothold establishment, privilege escalation, and lateral movement beyond typical Mirai-style DDoS operations.
The campaign is assessed as a significant threat to maritime operators because compromised shipboard DVRs could expose CCTV feeds covering areas such as the bridge, cargo holds, and engine room, flood satellite communications, and potentially enable lateral movement toward critical OT systems. Reporting states the campaign had been active for several months when identified, and that over 50,000 exposed DVRs had been observed as potential targets. High-confidence indicators and traits mentioned in the content include exploitation of CVE-2024-3721 on TBK DVR devices, use of Netlink-based process monitoring, custom C2 with a Magic Header, UDP-flood DDoS capability, in-memory multi-architecture loading, credential harvesting from /etc/passwd and /etc/shadow, and process termination of competing malware or hostile processes.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The Broadside malware infects TBK DVR devices impacted by CVE-2024-3721, an OS command injection flaw that can be exploited remotely for arbitrary code execution.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Broadside is a new variant of the Mirai botnet, active in the wild and likely used for DDoS attacks.
Mirai-based botnet variant that exploits a TBK DVR vulnerability, uses a custom C2 protocol and stealth techniques (e.g., Netlink kernel sockets, payload polymorphism), attempts to maintain exclusivity by killing competing processes, and harvests credential files (/etc/passwd, /etc/shadow) to establish foothold.
A new Mirai variant targeting TBK DVRs, especially in the maritime sector, to build an IoT botnet for malicious activities.
Broadside is a Mirai-based botnet variant that targets TBK DVR devices, primarily in the maritime logistics sector. It exploits CVE-2024-3721 to compromise devices, enabling DDoS attacks, credential theft, privilege escalation, and lateral movement. It features custom C2 protocols, payload polymorphism, and process-killing modules for persistence and stealth.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.