← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
IOC - Tracking Mirai Variant Nexcorium: A Vulnerability-Driven IoT Botnet Campaign | FortiGuard Labs
WHITE celestre 2026-04-21 Modified: 2026-05-21
20
IOCs
MEDIUM VOLUME
A list of highlights from FortiGuard Labs’s analysis of the Mirai botnet campaign, which exploited a vulnerability in TBK DVRs to launch large-scale cyber attacks.
脅威リサーチ2026fortiguard labs threat researchfortinetcve201717215ddos attackxhackedbyheaderfortigatefortimailforticlientfortiedrfortiguard webserviceteamnexcoriummirai
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Nexcorium Mirai
Indicators of Compromise (20)
All CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 hostname
TYPEINDICATORDESCRIPTIONCREATED
CVE CVE-2017-17215 — 2026-04-21
CVE CVE-2024-3721 — 2026-04-21
FileHash-MD5 353874dd1e12a7f67ba4f7ecbcbcb2af MD5 of 696aeb6321313919f0a41a520e6fa715450bbfb271a9add1e54efe16484a9c35 2026-04-21
FileHash-MD5 aaed4dca8bd6bb42fc4efb358a02a554 MD5 of 89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400 2026-04-21
FileHash-SHA1 98d2ef26e37be7f8e0c9b1b45329a5288c832ea1 SHA1 of 696aeb6321313919f0a41a520e6fa715450bbfb271a9add1e54efe16484a9c35 2026-04-21
FileHash-SHA1 ebdae1b6a28589ecc8d84557f0e83963396291cf SHA1 of 89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400 2026-04-21
FileHash-SHA256 0b510f93f47590791626d2fa74ddd62ba6eb8a5a5bb7b8476c0ceffc7be94ebe — 2026-04-21
FileHash-SHA256 29404df12a7723ce46c8b199c88a808aa315dd8ff8fd1e06a34ccd3d16f4553b — 2026-04-21
FileHash-SHA256 2ccf23b8165e8c05899aa7ba4755b896ebf1d20d3b701cffdc768482486b0a74 — 2026-04-21
FileHash-SHA256 37132e804ccb3fc4ba1f72205da70c3d7a6e66b43178707a9d8ee1156d815c21 — 2026-04-21
FileHash-SHA256 696aeb6321313919f0a41a520e6fa715450bbfb271a9add1e54efe16484a9c35 — 2026-04-21
FileHash-SHA256 721c7cb2109ec97c14413cb8b58ddce0ecf0c1f13f22ee4f72eed79b57592cf5 — 2026-04-21
FileHash-SHA256 7c01d5b53861cd34e10a79fdea16dcf08bce9c78ed72abd6d6f3e9ce75a24734 — 2026-04-21
FileHash-SHA256 838e35b62a6b38675e467301166cdcc54f98d528fe43d56936caeffec88ac696 — 2026-04-21
FileHash-SHA256 89dae116c77b0035277d39dfe01043624427c119ddee8883a3ba54a42a6ae400 — 2026-04-21
FileHash-SHA256 95d1eb12d58206319c514c7240d058c512bb22b31f6ea22ed8be3ae44305c9f7 — 2026-04-21
FileHash-SHA256 9b805585c457811d2c5c5664ede9ee869b53e3c9999100505d7ee8de7f855fdf — 2026-04-21
FileHash-SHA256 b1274de00a7f3d7ab9792ec3456e9d5bf057738666f34183f1d72060e2d4f678 — 2026-04-21
FileHash-SHA256 e4789416c35b345e75c023a8c07c207c79937c6a5444e1c29d85d18d2f660d8c — 2026-04-21
hostname r3brqw3d.b0ats.top — 2026-04-21
References (1)
↗ https://www.fortinet.com/jp/blog/threat-research/tracking-mirai-variant-nexcorium-a-vulnerability-driven-iot-botnet-campaign