Mirai Variant “LZRD” Exploits Long-Ignored Flaws in Legacy GeoVision IoT Devices
A fresh wave of cyberattacks is sweeping across the Internet of Things (IoT) space, as a variant of the infamous Mirai botnet resurfaces—this time targeting obsolete GeoVision smart devices vulnerable to long-standing command injection flaws.
The ongoing campaign exploits two critical security issues—CVE-2024-6047 and CVE-2024-11120—that, although disclosed in mid and late 2024, remained largely dormant and unexploited until now. These flaws enable unauthenticated attackers to run arbitrary commands remotely, setting the stage for mass malware deployment.
Due to a lack of public technical disclosure and minimal awareness, many affected systems remained exposed and unpatched—an oversight now being capitalized upon by threat actors. The vulnerabilities lie specifically in the /DateSetting.cgi API endpoint, where input filtering for the szSrvIpAddr parameter is insufficient, allowing malicious payloads to slip through.
This is particularly concerning as the devices in question are discontinued and no longer receive firmware updates or security patches. As a result, enterprises still running these units must now weigh the cost of replacing functioning but unsupported devices against the very real threat of compromise.
Researchers at Akamai uncovered the attack in early April 2025 via their extensive network of honeypots. Their investigation traced the activity back to a Mirai offshoot named LZRD, which is also targeting other unpatched IoT devices, including those from DigiEver.
How the Infection Works
The attack vector involves sending carefully crafted HTTP requests to the vulnerable GeoVision interface. The payload, embedded in the szSrvIpAddr parameter, includes shell commands that retrieve and execute a malware binary labeled “boatnet”—a hallmark of Mirai-based campaigns optimized for ARM devices.
Once executed, the malware prints a distinctive message to the system console, helping researchers fingerprint the variant:
ruby
root@ubuntu2404-amd64-20250307-en-5:~# lzrd cock fest”/proc/”/e
LZRD includes a familiar suite of denial-of-service tools seen in other Mirai versions, such as:
sym.attack_udp_plainsym.attack_tcp_acksym.attack_method_hexfloodsym.attack_tcp_stompsym.attack_method_tcpxmas
Hardcoded into the malware is a command-and-control (C2) server at 198.23.212.246, embedded within the sym.resolve_cnc_addr() routine. The C2 host emits a signature banner message nearly identical to those used by the InfectedSlurs/TBOTNET operations, indicating possible code sharing or direct lineage.
What Organizations Must Do Now
This campaign underscores a critical, recurring issue in the IoT ecosystem: the long-term exposure of unsupported, end-of-life hardware. Organizations still using vulnerable GeoVision models must urgently:
- Decommission and replace affected devices with supported alternatives.
- Isolate IoT systems using VLANs or segmented networks.
- Deploy intrusion detection and response systems to flag abnormal outbound traffic and known malware behavior patterns.
The LZRD campaign demonstrates how easily forgotten weaknesses can evolve into widespread threats when proactive security lapses persist. Legacy IoT hardware is no longer a low-priority concern—it’s a live risk vector.
