TBK DVRs Botnet Attack

Widespread Exploitation Attempts Targeting IoT Device

Threat Actors are actively exploiting CVE-2024-3721, a command injection vulnerability in TBK DVR devices (Digital Video Recorders). This flaw allows unauthenticated remote code execution (RCE) via crafted HTTP requests to the endpoint. The compromised devices are conscripted into a botnet capable of conducting DDoS attacks. Learn More »

Common Vulnerabilities and Exposures

Background

FortiGuard Labs has detected a significant increase in malicious network activity exploiting CVE-2024-3721, a critical unauthenticated command injection vulnerability affecting TBK DVR devices. FortiGuard’s global network of intrusion prevention system (IPS) sensors recorded over 60,000 detection events, indicating widespread and coordinated exploitation attempts.

Our telemetry data reveals that multiple botnet operators are actively leveraging this vulnerability to expand their infrastructure. Notably, we have observed payloads and behaviors associated with Condi, Fodcha, Mirai, and Unstable botnet families- each known for targeting IoT devices to perform large-scale distributed denial-of-service (DDoS) attacks and establish persistent remote access. FortiGuard Labs continues to monitor this threat and will provide further intelligence as it becomes available.

FortiGuard has previously released an Outbreak Alert for a different TBK vulnerability (CVE-2018-9995) exploited to spread Remote Access Trojan called HiatusRAT.