Loading story…
A remote command execution zero-day in Merit LILIN DVR and NVR devices was exploited in the wild to spread Mirai malware, according to 360 Netlab. The flaw affected the GET /getclock interface, where the NTP_SERVER parameter was not properly validated and could be injected into a shell command via syscmd and shared memory. Attackers reportedly combined the bug with default credentials to compromise exposed devices, and telemetry from 360 Netlab's Anglerfish honeypot showed exploitation activity tied to Mirai propagation infrastructure.
The researchers said they reported the issue to Merit LILIN, which released a firmware fix identified as version 4.0.26.5618, with firmware resources made available through the vendor's support channel. Netlab estimated that more than 1 million internet-exposed devices matched LILIN DVR fingerprints and that 6,748 were likely vulnerable at the time of analysis. The report also documented affected firmware names, malware hashes, and download URLs associated with the campaign, underscoring the risk to organizations still running unpatched or default-configured surveillance systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
360 Netlab reported the newly observed LILIN DVR/NVR vulnerability to Merit LILIN on September 21, 2020. The issue involved command injection through the GET /getclock interface's NTP_SERVER parameter.
On August 26, 2020, 360 Netlab's Anglerfish honeypot detected a new remote command execution zero-day affecting Merit LILIN DVR/NVR devices being exploited in the wild. Attackers paired the flaw with default credentials to compromise devices and spread a Mirai sample.
After receiving the report, Merit LILIN fixed the vulnerability overnight and provided firmware version 4.0.26.5618. The update added validation to the NTP_SERVER handling to prevent command injection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A renewed **Mirai** botnet campaign is targeting internet-exposed routers and IoT devices by exploiting known vulnerabilities, with advisories highlighting compromises affecting industrial routers, smart home systems, DVRs, cameras, and 5G/LTE equipment. Reported targets include devices from **ASUS, Huawei, Neterbit, LB-Link, Four-Faith, Kguard, Lilin,** and **Vimar**, as well as generic DVR platforms and PZT cameras, indicating broad opportunistic scanning of exposed edge infrastructure. National CERT advisories from Brunei and Colombia warned that Mirai-related botnet activity continues to threaten consumer and industrial environments, including routers and other connected devices. Defenders were urged to **patch exposed systems**, **disable remote access where possible**, **replace default credentials with strong unique passwords**, and **scan networks for vulnerable or internet-facing assets** to reduce the risk of botnet enrollment and downstream abuse such as distributed denial-of-service activity.
Aug 1, 2026
Researchers reported continued evolution of the Go-based **BotenaGo** malware family, which was previously observed targeting millions of routers and IoT devices with more than 30 embedded exploits. A newly identified derivative, dubbed **Lillin scanner**, narrows that broad approach and instead focuses on **Lilin security camera DVRs**, reusing portions of leaked BotenaGo source code while dropping most of the original exploit set. The malware attempts **HTTP basic authentication** with 11 hardcoded credential pairs and exploits an older critical **command-injection** flaw in the DVR's NTP configuration interface by sending crafted POST requests to `/dvr/cmd` or `/cn/cmd`. Successful compromise causes the device to fetch `wget.sh` from `136.144.41[.]169`, which then downloads and executes **Mirai** binaries for multiple CPU architectures. Researchers said the tool appears designed for manual or semi-manual targeting rather than fully autonomous worm-like propagation.
Aug 15, 2026
Palo Alto Networks Unit 42 reported two previously unidentified command-injection vulnerabilities in internet-exposed IoT services that were actively exploited to deliver **Mirai** malware. One campaign abused an unsanitized `NTP_SERVER` HTTP parameter in a web service used to configure NTP settings, while the other targeted an unsanitized `pid` HTTP parameter in what researchers believe was a remote process management service. In successful intrusions, the attackers invoked `wget` to fetch a shell script that then downloaded and executed Mirai binaries built for multiple processor architectures. Researchers observed the first campaign between July and September 2020 and a second burst of exploitation that generated 48 incidents in 12 seconds. Across both campaigns, four Mirai variants were deployed, all capable of **DDoS** activity, while one variant also carried worm-like propagation features that leveraged numerous known IoT and remote-code-execution exploits. The findings underscore the continued exposure created by unsupported IoT devices, and the report included indicators of compromise such as malware hashes, hosting IP addresses, and Mirai command-and-control domains.
Aug 14, 2026