Loading story…
Attackers exploited CVE-2021-36260, a critical unauthenticated remote code execution flaw in Hikvision IP cameras and NVRs, to compromise exposed devices and install the Mirai-based Moobot botnet. The vulnerability stems from improper input validation in the web server’s language parameter, allowing command injection without authentication on vulnerable firmware. Public reporting and technical writeups showed the flaw could be used to execute arbitrary commands remotely against internet-facing surveillance systems.
Fortinet reported that observed attacks used the flaw to drop a small ARM downloader, retrieve a Moobot payload from 199.195.250[.]233, and run it as macHelper. The malware then communicated with the command-and-control domain life.zerobytes[.]cc, sent heartbeat traffic, and enabled multiple distributed denial-of-service capabilities, including SYN, UDP, ACK, and ACK+PUSH flood attacks. Researchers also linked the activity to a Telegram channel advertising DDoS services, while Hikvision issued patches and defenders published detection and blocking coverage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Hikvision assigned CVE-2021-36260 and released a patch on the same day the vulnerability was publicly disclosed. The flaw is a critical unauthenticated command injection issue affecting Hikvision IP cameras and NVR products.
The 'tianrian' Telegram channel began offering DDoS services in August 2021, according to Fortinet's analysis.
The Telegram channel 'tianrian', later linked by researchers to advertised DDoS services, was created on June 11, 2021.
Fortinet released the IPS signature Hikvision.Product.SDK.WebLanguage.Tag.Command.Injection in IPS definition version 18.192 and documented related antivirus detections for the Mirai-based malware samples.
Fortinet observed attackers exploiting CVE-2021-36260 to drop an ARM downloader, fetch a Moobot payload from 199.195.250[.]233, and execute it as 'macHelper' on vulnerable Hikvision devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
fortinet.com
Open sourcewatchfulip.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported renewed **Moobot** activity as operators updated infrastructure and scanned for exploitable internet-facing devices, especially **Tenda routers**, while continuing a broader pattern of targeting networking gear and embedded systems. Alien Labs linked the latest activity to a Mirai-derived botnet probing for known flaws including `CVE-2014-8361`, `CVE-2017-17215`, `CVE-2018-14558`, and `CVE-2020-10987`. Earlier reporting described Moobot as an active DDoS botnet that spread through weak Telnet credentials and exploits affecting routers, DVRs, IP cameras, GPON devices, ThinkPHP, and Android Debug Bridge, with operators using obfuscation, modified packers, DNS TXT-based command-and-control delivery, and proxy infrastructure including SOCKS and Tor to complicate analysis. Separate campaigns showed the botnet repeatedly shifting to new device classes and vulnerabilities to grow its node base. Unit 42 documented MooBot exploiting four **D-Link** router flaws — `CVE-2015-2051`, `CVE-2018-6530`, `CVE-2022-26258`, and `CVE-2022-28958` — to fetch shell-script droppers and architecture-specific binaries, while Netlab 360 and CNCERT reported exploitation of a zero-day command-injection flaw in **UNIX CCTV DVR/NVR** devices through port `8000`, affecting about **6,000** exposed systems. Across the campaigns, the malware retained core Mirai traits, including embedded credentials, persistence, and DDoS capability, while variants such as `Moobot_xor` and `Moobot_leet` introduced altered encryption keys, encrypted resources, and Tor-based C2 channels.
Aug 15, 2026
A backdoor in **Xiongmai-based DVRs, NVRs, and IP cameras** exposed affected devices to remote takeover by allowing attackers to recover a pre-shared key, authenticate over **TCP/9530**, and enable **telnet** access for root-level control. The issue affected products sold under many brands and hundreds of models, particularly devices built on HiSilicon-based hardware running Xiongmai firmware, with Internet-exposed vulnerable systems estimated in the hundreds of thousands to millions. Public reporting said the flaw stemmed from Xiongmai software rather than HiSilicon itself, and warned that patching across the fragmented OEM ecosystem was unreliable. Researchers later linked active exploitation of the flaw to **LeetHozer**, a Mirai-like IoT botnet that targeted Xiongmai **H.264/H.265** devices by abusing port 9530 to turn on telnet and then logging in with default credentials. Netlab 360 said the malware appeared related to the **Moobot** ecosystem through shared exploit strings and downloader infrastructure, while using redesigned bot logic, encryption, and C2 communications. Once installed, LeetHozer supported multiple DDoS functions, including `tcpraw`, `icmpecho`, and `udpplain`, showing how a widely deployed firmware backdoor moved quickly from public disclosure to operational botnet abuse.
Aug 15, 2026
MBSD-SOC reported a sharp rise in exploitation attempts against Hikvision network cameras using **`CVE-2021-36260`**, an unauthenticated OS command injection flaw in the products’ web server component. The vulnerability stems from improper input validation and can allow remote code execution as the `root` user by sending crafted requests to the device. The observed attacks used a `PUT` request to `/SDK/webLanguage` and injected commands through XML content, with MBSD-SOC noting detections increased significantly after May 26, 2023. Telemetry showed most attack traffic originated from the United States, followed by Germany, Japan, France, and Romania, underscoring continued broad internet scanning and exploitation of exposed Hikvision devices.
Aug 15, 2026