Full Report
TBK DVRs targeted by Nexcorium: exploiting, persisting, brute-force attacks, and multi-architecture Mirai-style DDoS in a single campaign. From CVE-2024-3721 exploitation to CVE-2017-17215 reuse, this botnet demonstrates how quickly IoT threats continue to evolve.
Analysis Summary
# Tool/Technique: Nexcorium (Mirai Variant)
## Overview
Nexcorium is a multi-architecture IoT botnet and variant of the Mirai malware family. It primarily targets TBK DVR devices by exploiting contemporary and legacy vulnerabilities to recruit devices into a botnet capable of launching Distributed Denial-of-Service (DDoS) attacks, performing brute-force credential stuffing, and scanning for further network expansion.
## Technical Details
- **Type:** Malware Family (Mirai Variant)
- **Platform:** Linux (Multiple architectures: ARM, MIPS R3000, x86-64/AMD64)
- **Capabilities:** Command injection, persistence, DDoS, credential brute-forcing, self-replication, and automated vulnerability scanning.
- **First Seen:** April 2024 (associated with CVE-2024-3721 exploitation)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application]
- **[TA0003 - Persistence]**
- [T1543 - Create or Modify System Process]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information] (XOR-encoded configs)
- [T1140 - Decompress/Decrypt Files or Information]
- **[TA0007 - Discovery]**
- [T1083 - File and Directory Discovery]
- **[TA0009 - Collection]**
- [T1115 - Data from Local System]
- **[TA0040 - Impact]**
- [T1498 - Network Denial of Service]
## Functionality
### Core Capabilities
- **Multi-Exploit Delivery:** Utilizes CVE-2024-3721 (TBK DVR OS command injection) for initial delivery via a downloader script named `dvr`.
- **Botnet Architecture:** Employs the classic Mirai structure consisting of three core modules:
- **Watchdog:** Ensures malware persistence and monitors child processes (marker: `NXS_WD_CHILD`).
- **Scanner:** Brute-forces credentials and exploits vulnerabilities (CVE-2017-17215) in Huawei HG532 devices to spread.
- **Attacker:** Executes DDoS commands received from the Command and Control (C2) server.
- **Configuration Obfuscation:** Uses XOR encoding (keys identified: `0x13` and `0xFD`) to hide C2 domains, ports, and brute-force wordlists.
### Advanced Features
- **Self-Integrity Checks:** Uses the FNV-1a hashing algorithm to verify its own executable. If the hash is modified or the file is missing, it triggers self-replication to a new location.
- **Custom Artifacts:** The exploit traffic includes a unique HTTP header `X-Hacked-By: Nexus Team – Exploited By Erratic`.
- **Environment Awareness:** The downloader script passes arguments to the binary to identify the specific type of host exploited.
## Indicators of Compromise
- **File Hashes (SHA256):**
- Downloader: `696aeb6321313919f0a41a520e6fa715450bbfb271a9add1e54efe16484a9c35`
- Nexcorium Samples:
- `37132e804ccb3fc4ba1f72205da70c3d7a6e66b43178707a9d8ee1156d815c21`
- `e4789416c35b345e75c023a8c07c207c79937c6a5444e1c29d85d18d2f660d8c`
- `0b510f93f47590791626d2fa74ddd62ba6eb8a5a5bb7b8476c0ceffc7be94ebe`
- **File Names:** `dvr` (downloader script), `nexuscorp.[arch]` (malware binaries)
- **Network Indicators:**
- `84[.]200[.]87[.]36`
- `176[.]65[.]148[.]186`
- `r3brqw3d[.]b0ats[.]top`
- **Behavioral Indicators:**
- Execution strings: "nexuscorp has taken control".
- Presence of processes with role marker `NXS_WD_CHILD`.
- Manipulation of `/proc/self/exe`.
## Associated Threat Actors
- **Nexus Team** (identified via the "X-Hacked-By" custom HTTP header).
## Detection Methods
- **Signature-based:** Standard AV signatures for Mirai variants; IPS signatures for CVE-2024-3721 and CVE-2017-17215.
- **Network-based:** Monitoring for the specific "X-Hacked-By" HTTP header in incoming requests to IoT management interfaces.
- **Behavioral:** Detecting unauthorized binary execution in `/tmp` or unusual outbound scanning activity on ports 23, 2323, or 37215.
## Mitigation Strategies
- **Patch Management:** Immediately patch TBK DVR devices against CVE-2024-3721 and Huawei devices against CVE-2017-17215.
- **Access Control:** Restrict access to IoT device management interfaces behind a VPN or firewall; disable Telnet/SSH if not required.
- **Credential Hardening:** Change default factory passwords to strong, unique credentials to prevent brute-force attacks.
- **Network Segmentation:** Isolate IoT devices (like DVRs) from critical business networks to prevent lateral movement.
## Related Tools/Techniques
- **Mirai:** Original source code upon which Nexcorium is built.
- **Gafgyt/BASHLITE:** Similar IoT botnet families using common Linux exploit techniques.
- **CVE-2017-17215:** Legacy exploit frequently reused by IoT botnets for rapid propagation.