Cydome flags Mirai variant Broadside, targets maritime logistics through TBK DVR devices

New research from Cydome’s cybersecurity team identified an active campaign of a new variant of the Mirai botnet, designated as ‘Broadside.’ The campaign was found to target the maritime logistics sector, exploiting a vulnerability (CVE-2024-3721) in TBK DVR (digital video recorders) devices in use by shipping companies on vessels, among others. Cydome has been tracking the associated infrastructure over the past months, observing that active IPs rise and fall in alignment with the campaign’s activity.

“Unlike Mirai variants, Broadside employs a custom C2 protocol, a unique ‘Magic Header’ signature, and an advanced ‘Judge, Jury, and Executioner’ module for exclusivity,” the Cydome Research Team wrote in a recent post. “Technically, it diverges from standard Mirai by utilizing Netlink kernel sockets for stealthy, event-driven process monitoring (replacing noisy filesystem polling), and employing payload polymorphism to evade static defenses.”

Crucially, Cydome mentioned that the threat extends beyond denial-of-service attacks; analysis confirms that Broadside actively attempts to harvest system credential files. This indicates a secondary objective of privilege escalation and lateral movement , transforming the compromised device from a simple bot into a strategic foothold.

The post identified that the function of a botnet is to take part in distributed denial of service (DDoS) attacks. This could flood the vessel’s network and satellite communications with a high volume of traffic, potentially impacting the connectivity of other, mission-critical systems.

The Cydome team said that the attack targeted TBK DVR devices through a remote command injection exploiting CVE-2024-3721 on the /device.rsp endpoint via HTTP POST.

ey attack capabilities include high-rate UDP flooding with basic payload polymorphism, stealthy persistence achieved through Netlink-based process monitoring, and dynamic termination and blacklisting of competing processes. The attack also enabled access to files during runtime, indicating local account enumeration and privilege validation. The campaign remains active, with confirmed command-and-control communications using a custom protocol over TCP port 1026, along with fallback communications over TCP port 6969.

Recommended mitigation measures include verifying that systems are updated and patched, and reviewing the usage of the DVR system to ensure it is not exposing unnecessary risks. It is also crucial to use a Network Detection and Response (NDR) or Extended Detection and Response (XDR) system alongside a firewall and Endpoint Detection and Response (EDR) solution for enhanced protection.

Follow best practices for network segmentation to isolate critical operational systems from the broader network. Additionally, implement proactive vulnerability scanning and maintain patching hygiene to prevent future attacks. Many attacks exploit known vulnerabilities, relying on slow patching cycles. For instance, Broadside targets CVE-2024-3721, which was already patched by TBK.

Lastly, enforce strong password and credential hygiene practices, including multi-factor authentication (MFA), to prevent unauthorized access.

In July, Cydome launched a free cyber-incident reporting tool, coinciding with the introduction of new federal enforcement rules for U.S. maritime operators. With U.S. Coast Guard regulations now in effect as of July 16, shipowners and offshore operators are required to report cyber incidents, marking the start of a more aggressive regulatory posture. The tool gave operators immediate compliance support as they became federally required to report cyber incidents under U.S. law.