Loading threat actor…
DVR Botnet is a Mirai-family botnet variant observed reactivated in late 2025 and associated with the compromise of TBK digital video recorder devices. It is part of the broader Mirai ecosystem of IoT malware that targets internet-exposed embedded Linux devices and repurposes them into botnets for distributed denial-of-service operations. Reported tradecraft for this variant includes exploitation of CVE-2024-3721, RC4-based string obfuscation, and anti-virtual-machine checks intended to hinder analysis. The actor’s activity is consistent with Mirai-derived operations focused on initial access to vulnerable IoT devices, persistence within the botnet, and use of the resulting infrastructure for large-scale DDoS attacks. No high-confidence evidence in the available material supports ransomware or extortion activity by this specific variant.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.