Loading malware…
DvrHelper is a Mirai-derived IoT botnet malware variant associated with attacks against internet-connected embedded devices, including IP cameras and related DVR/NVR equipment. It emerged after the public release of Mirai source code and extends the original botnet with additional distributed denial-of-service functionality, including multiple added attack modules and Layer 7 techniques intended to bypass commercial anti-DDoS protections. Reported bypass methods included relaying challenge logic to command-and-control infrastructure for remote execution and reusing challenge-response artifacts to obtain valid session cookies, allowing protected web targets to be attacked despite the limited resources of infected devices.
DvrHelper is part of the broader Mirai ecosystem of Linux ELF malware targeting vulnerable IoT systems. It has been discussed alongside other camera-focused botnets such as Persirai and TheMoon in the context of competition for a finite pool of exposed devices. Mirai-family botnets, including DvrHelper, are known for compromising embedded Linux devices and using them as nodes in large-scale DDoS operations. DvrHelper is notable for adapting Mirai’s model toward application-layer attacks and anti-mitigation evasion rather than relying only on the earlier volumetric methods associated with Mirai.
The malware runs on Linux-based embedded platforms and is best characterized as a botnet-oriented trojan/backdoor used for post-compromise remote control and DDoS activity. High-confidence reporting supports its role as an IoT-focused Mirai variant with enhanced DDoS capabilities and defense-evasion features aimed at defeating web protection challenges.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as one of several malware signatures TuxBot attempts to kill on infected devices.
Referenced as a Mirai variant previously observed conducting Layer 7 DDoS attacks against DDoS-protection services.
A Mirai variant referenced as a prior example of Layer 7 DDoS attacks against DDoS-protection service vendors.
Mirai-derived IoT malware targeting IP cameras, with expanded DDoS functionality and techniques intended to bypass anti-DDoS protections, including challenge-response handling and shared reCAPTCHA token abuse.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.