# Japanese NVR and router devices show coordinated compromise patterns

Published: 2026-03-30 · Severity: routine · Sectors: government-national, manufacturing, infrastructure
Canonical: https://vorant.io/reports/6b32a543-a0e2-5dbc-b5b6-4924b7a6c3ee/japanese-nvr-and-router-devices-show-coordinated-compromise-patterns

> JPCERT observes suspicious packets from NVR, business routers, and SDN controllers in Japan suggesting coordinated compromise via standardized configuration deployment.

JPCERT/CC's TSUBAME internet observation system detected suspicious packet activity originating from multiple Japanese IP addresses hosting NVR products, domestic business-grade routers, and SDN controller devices. A significant finding is that these devices across different IP addresses listen on identical port numbers for their web interfaces, suggesting they were configured identically during initial deployment ("kitteikingu") by a single system administrator or systems integrator. The compromised devices expose their login screens externally, and analysis of domestic router management interfaces reveals prefecture abbreviations suggesting multi-region deployment. The suspicious outbound packet activity indicates at least one device in each IP cluster has been compromised. JPCERT has attempted to contact affected organizations without success. Separately, TSUBAME sensors worldwide show consistent scanning activity targeting common service ports (22/TCP, 23/TCP, 80/TCP, 443/TCP, 8080/TCP) across diverse networks, with foreign sensors observing significantly higher packet volumes than domestic sensors.

## Detection guidance (public sample)

### Port Scanner Run Against Common IoT/Router Service Ports (22/23/80/443/8080)

ATT&CK: T1046

Scanner binary (nmap, masscan, zmap) executed on a Windows host with a port list covering 22, 23, 80, 443 and 8080, the service ports the report says are swept to find exposed NVR and router interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Port Scanner Run Against Common IoT/Router Service Ports (22/23/80/443/8080)
description: Detects well-known network scanners (nmap, masscan, zmap) launched with
  a port list covering 22, 23, 80, 443 and 8080 - the service ports swept to find
  exposed NVR, router and SDN controller management interfaces. Generalises on scanner
  plus port-set pattern, not on target addresses.
tags:
- attack.discovery
- attack.t1046
- attack.reconnaissance
- attack.t1592
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \nmap.exe
    - \masscan.exe
    - \zmap.exe
  selection_ports:
    CommandLine|contains|all:
    - -p
    - '22'
    - '23'
    - '80'
    - '443'
    - '8080'
  condition: selection_img and selection_ports
falsepositives:
- Authorised vulnerability assessment or asset inventory scans run by IT or security
  teams
- Network engineers troubleshooting reachability of management interfaces with nmap
level: medium
id: 01f4a35a-0bb7-5991-8e6d-b2a7bbce95ef
status: experimental
author: Vorant
references:
- https://blogs.jpcert.or.jp/ja/2026/03/tsubame-overflow20250709.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://blogs.jpcert.or.jp/ja/2026/03/tsubame-overflow20250709.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6b32a543-a0e2-5dbc-b5b6-4924b7a6c3ee/japanese-nvr-and-router-devices-show-coordinated-compromise-patterns.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup