Threats Day Bulletin: Spyware Alerts, Mirai Strikes, Docker Leaks, ValleyRAT Rootkit — and 20 More Stories
Summary: A new Mirai botnet variant called Broadside is exploiting a critical-severity flaw in TBK DVR (CVE-2024-3721) against the maritime logistics sector, using a custom C2 protocol, a 'Magic Header' signature, Netlink kernel sockets for stealthy process monitoring, and a module that kills competing processes while harvesting /etc/passwd and /etc/shadow. Apple and Google sent a new round of spyware notifications to users in nearly 80 countries, and New Zealand's NCSC is notifying around 26,000 users infected with Lumma Stealer in what it called its first large-scale public outreach.
Why it matters: Broadside does not stop at denial of service: it reads /etc/passwd and /etc/shadow to hold a compromised device, so a DVR on your network is a credential-theft foothold, not just an outage. And 26,000 Lumma Stealer infections in one country is the scale of credential theft most organizations never get told about.
Read the original at The Hacker News ↗
- Topics
- Malware
- Mentions
- CVE-2024-3721
- Related
- Threats Day Bulletin: AI Malware, Voice Bot Flaws, Crypto Laundering, IoT Attacks — and 20 More Stories Cyber Risks ·ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026