nexus team

Executive Summary

The Nexus Team is an IoT-focused threat actor that has recently deployed a Mirai‑variant botnet called Nexcorium, leveraging the CVE-2024-3721 vulnerability in TBK DVR devices to gain footholds and install its payload. Once the malware is on a device it establishes persistence, performs brute‑force credential guessing against Telnet interfaces, and reports back to a command‑and‑control domain (r3brqw3d.b0ats.top) from which it orchestrates large‑scale DDoS attacks. The actor’s operations suggest an ongoing, high‑tempo campaign targeting both industrial control systems and consumer IoT devices across multiple regions.

Goals & Targeting

The Nexus Team’s strategic objectives appear focused on causing widespread service disruption via high‑volume DDoS attacks against a diverse portfolio of sectors—including information technology, telecommunications, energy, defense, mining, government, education, and pharmaceuticals—across the United States, China, Vietnam, Australia, and Kazakhstan. The actor prioritizes low‑value, high‑impact targets such as IoT gateways, industrial control systems, and consumer network devices that can be quickly compromised through default or weak credentials and publicly disclosed vulnerabilities.

Key Capabilities

• Exploits CVE-2024-3721 on TBK DVR devices via OS command injection
• Downloads Mirai variant binaries for ARM, MIPS, and x86‑64 architectures using a custom downloader script 'dvr'
• Performs brute-force Telnet credential guessing with hard-coded default username/password lists
• Establishes persistence by copying itself to /usr/local/bin/sysd and creating init scripts, systemd services, and cron jobs
• Implements self-integrity checks through hash validation and duplicates malicious code upon tampering
• Communicates with a command-and-control domain (r3brqw3d.b0ats.top) to receive DDoS attack commands
• Executes diverse network floods including UDP flood, TCP SYN/Ack/ACK flood, VSE query flood, and other impact tactics
• Exploits CVE-2017-17215 against Huawei HG532 routers for additional IoT footholds

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The Nexus Team demonstrates a recurring, high‑tempo campaign pattern characterized by rapid exploitation of publicly documented IoT vulnerabilities, automated brute‑force credential cracking to compromise devices, and immediate deployment of a lightweight Mirai-based botnet. Victim profiles skew toward networked industrial or consumer control devices—such as DVRs, routers, and SCADA components—that lack proper firmware patching and have weak authentication controls. Operational tempo is high; new vulnerabilities are leveraged quickly (e.g., CVE-2024‑3721 within days of disclosure), and the botnet can be re‑commissioned in minutes through automated download scripts. Notable past operations include widespread DDoS attacks on telecom infrastructure and energy utilities, with attackers leveraging custom HTTP headers for attribution and persistence mechanisms to survive defensive cleanup attempts.

IOC Patterns

• Custom HTTP header X-Hacked-By: "Nexus Team – Exploited By Erratic"
• Downloader script named 'dvr' requesting filenames prefixed with nexuscorp* for ARM/MIPS/x86_64
• C2 domain r3brqw3d.b0ats.top used to receive attack commands
• Exploitation of CVE-2024-3721 on TBK DVR devices and CVE-2017-17215 on Huawei HG532 routers
• Hard‑coded list of default credentials for Telnet brute‑force attempts

Recommended Actions

• Patch or update firmware on TBK DVR devices to address CVE‑2024‑3721 before exploitation occurs
• Segregate IoT device networks from critical infrastructure and enforce strict remote access policies
• Monitor HTTP traffic for the X-Hacked-By header and anomalous downloads matching nexuscorp* filenames
• Disable telnet services where not required; enforce strong authentication on remaining services
• Deploy detection mechanisms that flag processes copying themselves to /usr/local/bin or modifying file permissions
• Patch systems against CVE‑2017‑17215 on Huawei HG532 routers Implement rate limiting for Telnet login attempts to mitigate brute‑force attacks
• Detect and block outbound HTTPS traffic targeting r3brqw3d.b0ats.top or other known C2 domains
• Use IDS signatures to flag UDP/TCP SYN/ACK flood patterns originating from compromised devices
• Conduct regular integrity checks of critical system binaries
• Implement centralized logging and alerting for persistent persistence mechanisms such as cron entries, systemd services, and startup scripts

Suggested Tags