Japanese NVR and router devices show coordinated compromise patterns
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
JPCERT observes suspicious packets from NVR, business routers, and SDN controllers in Japan suggesting coordinated compromise via standardized configuration deployment.
JPCERT/CC's TSUBAME internet observation system detected suspicious packet activity originating from multiple Japanese IP addresses hosting NVR products, domestic business-grade routers, and SDN controller devices. A significant finding is that these devices across different IP addresses listen on identical port numbers for their web interfaces, suggesting they were configured identically during initial deployment ("kitteikingu") by a single system administrator or systems integrator. The compromised devices expose their login screens externally, and analysis of domestic router management interfaces reveals prefecture abbreviations suggesting multi-region deployment. The suspicious outbound packet activity indicates at least one device in each IP cluster has been compromised. JPCERT has attempted to contact affected organizations without success. Separately, TSUBAME sensors worldwide show consistent scanning activity targeting common service ports (22/TCP, 23/TCP, 80/TCP, 443/TCP, 8080/TCP) across diverse networks, with foreign sensors observing significantly higher packet volumes than domestic sensors.
Detection guidance
Port Scanner Run Against Common IoT/Router Service Ports (22/23/80/443/8080)
Scanner binary (nmap, masscan, zmap) executed on a Windows host with a port list covering 22, 23, 80, 443 and 8080, the service ports the report says are swept to find exposed NVR and router interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Port Scanner Run Against Common IoT/Router Service Ports (22/23/80/443/8080)
description: Detects well-known network scanners (nmap, masscan, zmap) launched with
a port list covering 22, 23, 80, 443 and 8080 - the service ports swept to find
exposed NVR, router and SDN controller management interfaces. Generalises on scanner
plus port-set pattern, not on target addresses.
tags:
- attack.discovery
- attack.t1046
- attack.reconnaissance
- attack.t1592
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \nmap.exe
- \masscan.exe
- \zmap.exe
selection_ports:
CommandLine|contains|all:
- -p
- '22'
- '23'
- '80'
- '443'
- '8080'
condition: selection_img and selection_ports
falsepositives:
- Authorised vulnerability assessment or asset inventory scans run by IT or security
teams
- Network engineers troubleshooting reachability of management interfaces with nmap
level: medium
id: 01f4a35a-0bb7-5991-8e6d-b2a7bbce95ef
status: experimental
author: Vorant
references:
- https://blogs.jpcert.or.jp/ja/2026/03/tsubame-overflow20250709.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/ja/2026/03/tsubame-overflow20250709.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs