Loading story…
A backdoor in Xiongmai-based DVRs, NVRs, and IP cameras exposed affected devices to remote takeover by allowing attackers to recover a pre-shared key, authenticate over TCP/9530, and enable telnet access for root-level control. The issue affected products sold under many brands and hundreds of models, particularly devices built on HiSilicon-based hardware running Xiongmai firmware, with Internet-exposed vulnerable systems estimated in the hundreds of thousands to millions. Public reporting said the flaw stemmed from Xiongmai software rather than HiSilicon itself, and warned that patching across the fragmented OEM ecosystem was unreliable.
Researchers later linked active exploitation of the flaw to LeetHozer, a Mirai-like IoT botnet that targeted Xiongmai H.264/H.265 devices by abusing port 9530 to turn on telnet and then logging in with default credentials. Netlab 360 said the malware appeared related to the Moobot ecosystem through shared exploit strings and downloader infrastructure, while using redesigned bot logic, encryption, and C2 communications. Once installed, LeetHozer supported multiple DDoS functions, including tcpraw, icmpecho, and udpplain, showing how a widely deployed firmware backdoor moved quickly from public disclosure to operational botnet abuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On the same day LeetHozer activity was first seen, researchers observed LeetHozer samples fetched from /ab/i686 and /ab/i586 and a moobot_xor sample fetched from /ab/arm from the same downloader infrastructure at 185.172.110.224. The overlap supported an assessment that the malware families were likely operated by the same actor or group.
Netlab 360 captured a suspicious malware sample later named LeetHozer. The sample marked the beginning of observed LeetHozer exploitation activity against Xiongmai H.264 and H.265 devices.
Researchers observed a moobot_xor variant exploiting the same TCP 9530 vulnerability in Xiongmai devices. This showed active weaponization of the issue shortly after the PoC became public.
A proof of concept for the Xiongmai device vulnerability exposed on TCP port 9530 was released on GitHub. The PoC demonstrated how attackers could trigger telnet on affected DVR, NVR, and IP camera devices.
A Chinese-language blog post documented how telnet could be enabled on Xiongmai cameras, showing public knowledge of the device access mechanism years before the 2020 GitHub PoC and later botnet exploitation. The post focused on research into Xiongmai camera telnet activation.
Hangzhou Xiongmai Technology published a security advisory addressing vulnerabilities affecting some XM products. The advisory predates the 2017 public blog documentation and later 2020 PoC and botnet exploitation activity already captured in the timeline.
Netlab 360 published technical analysis describing LeetHozer as a Mirai-like but distinct botnet family likely related to the Moobot group. The report documented its exploitation of Xiongmai devices via port 9530, default-credential logins, DDoS capabilities, and C2 infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceblog.netlab.360.com
Open sourcehabr.com
Open sourcecnblogs.com
Open sourcexiongmaitech.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited **CVE-2021-36260**, a critical unauthenticated remote code execution flaw in Hikvision IP cameras and NVRs, to compromise exposed devices and install the Mirai-based **Moobot** botnet. The vulnerability stems from improper input validation in the web server’s `language` parameter, allowing command injection without authentication on vulnerable firmware. Public reporting and technical writeups showed the flaw could be used to execute arbitrary commands remotely against internet-facing surveillance systems. Fortinet reported that observed attacks used the flaw to drop a small ARM downloader, retrieve a Moobot payload from `199.195.250[.]233`, and run it as **`macHelper`**. The malware then communicated with the command-and-control domain `life.zerobytes[.]cc`, sent heartbeat traffic, and enabled multiple distributed denial-of-service capabilities, including **SYN**, **UDP**, **ACK**, and **ACK+PUSH** flood attacks. Researchers also linked the activity to a Telegram channel advertising DDoS services, while Hikvision issued patches and defenders published detection and blocking coverage.
Aug 15, 2026
Fortinet and other reporting identified **Nexcorium**, a Mirai-derived malware strain targeting Internet of Things devices, particularly **TBK DVR-4104** and **DVR-4216** video recorder systems used with security cameras. The campaign exploits **`CVE-2024-3721`**, an OS command injection flaw, to run a downloader script that retrieves malware binaries for multiple Linux architectures. Fortinet linked the activity to a suspected actor it calls **Nexus Team**, citing the custom HTTP header `X-Hacked-By: Nexus Team – Exploited By Erratic.` Once installed, Nexcorium uses classic Mirai-style scanner, watchdog, and attack modules, establishes persistence through mechanisms including init, `rc.local`, systemd, and cron, and spreads further through brute-force Telnet activity, default-password abuse, and exploitation of **`CVE-2017-17215`** in Huawei HG532 devices. The malware performs self-checks, replication, and self-deletion to improve resilience and evasion, then connects to the command-and-control domain `r3brqw3d[.]b0ats[.]top` to receive instructions for **DDoS** operations, including UDP, TCP SYN, TCP ACK, SMTP, and VSE query floods.
Jun 29, 2026
Researchers reported continued evolution of the Go-based **BotenaGo** malware family, which was previously observed targeting millions of routers and IoT devices with more than 30 embedded exploits. A newly identified derivative, dubbed **Lillin scanner**, narrows that broad approach and instead focuses on **Lilin security camera DVRs**, reusing portions of leaked BotenaGo source code while dropping most of the original exploit set. The malware attempts **HTTP basic authentication** with 11 hardcoded credential pairs and exploits an older critical **command-injection** flaw in the DVR's NTP configuration interface by sending crafted POST requests to `/dvr/cmd` or `/cn/cmd`. Successful compromise causes the device to fetch `wget.sh` from `136.144.41[.]169`, which then downloads and executes **Mirai** binaries for multiple CPU architectures. Researchers said the tool appears designed for manual or semi-manual targeting rather than fully autonomous worm-like propagation.
Aug 15, 2026