RapperBot Targets DVRs to Hijack Surveillance Cameras and Record Video

When the NICT CSRI analysis team presented their three-year investigation into the RapperBot virus at Botconf 1, an international conference on botnets and malware hosted in Angers, France in May 2025, they made a startling discovery.

This Mirai variant has evolved into a sophisticated threat specifically targeting Digital Video Recorders (DVRs), devices connected to surveillance cameras for remote video recording and control.

Unveiling a Persistent Threat to IoT Security

The team’s findings, detailed in their presentation “Unveiling the DVR Ecosystem: A 3-Year Investigation into Global IoT Bot Recruitment Campaigns.”

It highlight how DVRs’ inherent vulnerabilities such as weak default passwords, open Telnet or HTTP ports on older devices, and infrequent firmware updates make them prime targets for cyber attackers aiming to infiltrate and exploit Internet of Things (IoT) ecosystems.

RapperBot employs a multi-pronged approach to compromise DVRs, utilizing brute force login attacks with credential ...