Cydome’s cybersecurity research team says that it has identified a new Mirai-based malware strain, observed in active attacks against maritime logistics networks.
The botnet variant, named Broadside, exploits a vulnerability in TBK DVR devices used onboard vessels.
The company says the threat is distinct from previous Mirai versions due to the use of a custom command-and-control protocol and stealthier persistence techniques. Broadside employs a custom C2 protocol, a unique ‘Magic Header’ signature, and a ‘Judge, Jury, and Executioner’ module for exclusivity.
It diverges from standard Mirai by utilising Netlink kernel sockets for event-driven process monitoring and employing payload polymorphism to evade static defences.
The analysis confirmed that Broadside actively attempts to harvest system credential files, allowing compromised devices to potentially be used to generate high-volume network traffic that disrupts vessel communications and interferes with operational systems.
Cydome says that it is continuing to track the infrastructure associated with the campaign as active IPs fluctuate based on attacker activity.
Recommended steps to protect against the botnet variant include patching affected hardware, enforcing network segregation, and maintaining strong credential policies to reduce risk.
Cydome says that it can can provide specific Identifiers and associated IPs for Broadside upon request.
