New Mirai Botnet Variant ‘Broadside’ Actively Attacking Users in the Wild

Cydome analysts identified "Broadside," a sophisticated Mirai variant actively exploiting CVE-2024-3721 in TBK DVRs used on maritime vessels; the malware installs via crafted HTTP POST requests, runs in-memory across ARM/MIPS/x86/PowerPC, and uses a hardcoded C2 "Magic Header" (0x36694201). Broadside includes dual process-monitoring modes (Netlink "Smart Mode" and aggressive "Panic Mode"), a process-killer module, credential harvesting from /etc/passwd and /etc/shadow, and persistent, polymorphic high-rate UDP flood capabilities that can saturate satellite uplinks and enable lateral movement within flat shipboard networks.