Ddos 
The Akamai Security Intelligence and Response Team (SIRT) has identified active exploitation of two command injection vulnerabilities — CVE-2024-6047 and CVE-2024-11120 — in discontinued GeoVision IoT devices. According to Akamai, this marks “the first reported active exploitation of these vulnerabilities since the initial disclosure in June 2024 and November 2024, respectively.”
The attackers are targeting the /DateSetting.cgi endpoint in vulnerable GeoVision devices, injecting malicious commands via the szSrvIpAddr parameter. These flaws enable unauthenticated remote attackers to execute arbitrary system commands.
Akamai explains: “Certain discontinued GeoVision devices fail to properly filter user input for this parameter, which allows unauthenticated remote attackers to inject and execute arbitrary system commands on a target system.”
Once exploited, the devices are forced to download and run a Mirai-based malware variant dubbed LZRD, sourced from a malicious URL:
The payload execution string is tailored for ARM-based devices and is injected via a crafted HTTP POST request.
Upon execution, the malware prints a unique console string to the victim machine — a calling card of the LZRD variant. Akamai researchers also observed a series of attack functions consistent with Mirai’s lineage, including:
- sym.attack_method_tcp
- sym.attack_udp_plain
- sym.attack_method_ovh
- sym.attack_method_stdhex
Additionally, analysts discovered a hardcoded command-and-control (C2) IP address within the malware’s sym.resolve_cnc_addr() function. This infrastructure included banners eerily similar to those seen in past campaigns, notably the InfectedSlurs botnet.
The LZRD-powered botnet doesn’t stop at GeoVision devices. Akamai’s honeypots recorded attempts to exploit several other known vulnerabilities, including:
- A Hadoop YARN vulnerability
- CVE-2018-10561 (ZTE ZXV10 H108L Router)
- A DigiEver IoT flaw previously reported by Akamai
One such payload attempted to fetch and run a script from:
To aid defenders, Akamai has included indicators of compromise (IOCs) in their full report and urges organizations to:
- Retire or isolate outdated IoT devices.
- Monitor network traffic for anomalous connections to known C2 IPs.
- Block known malicious endpoints, including hiddenbin/boatnet.arm7 and associated domains.
Donate