Compromised Japanese NVRs send malicious packets
JPCERT TSUBAME sensors detected suspicious packets from compromised NVR devices and enterprise routers in Japan, with scanning activity targeting common ports observed globally from July-September 2025.
JPCERT's TSUBAME honeypot network observed suspicious network traffic originating from compromised devices in Japan during Q3 2025, extending beyond previously reported TP-Link router infections. Investigation revealed packets transmitted from domestic NVR (Network Video Recorder) products deployed alongside enterprise routers and SDN controllers, all configured with identical port numbers across multiple IP addresses. The uniform configuration patterns and presence of prefecture name abbreviations suggest these systems were provisioned by a single systems integrator or service provider across multiple regions. JPCERT has attempted but not yet succeeded in contacting the affected organizations.
Comparative analysis between domestic and overseas TSUBAME sensors showed overseas sensors received higher packet volumes overall. Domestic sensor traffic peaked in July before declining through September, while overseas traffic dipped in August but rebounded in September. Across all sensor locations—Japan, North America, Europe, and other regions—scanning activity consistently targeted ports 22/TCP, 23/TCP, 80/TCP, 443/TCP, and 8080/TCP, indicating widespread reconnaissance campaigns against SSH, Telnet, HTTP, HTTPS, and alternative HTTP services. While no critical incidents were identified this quarter, JPCERT emphasizes the importance of continued vigilance against scanning activity and systematic device compromise.
Detection guidance
Recon Scan Against Common IoT/Router Management Ports
Detects inbound connection attempts from external hosts to the port set (22,23,80,443,8080) consistent with mass vulnerability scanning of exposed NVR/router/SDN devices reported by JPCERT TSUBAME sensors. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Recon Scan Against Common IoT Management Ports
id: b770b897-cc95-5df7-a435-d195c0c93eeb
status: experimental
description: 'Identifies inbound connection attempts from untrusted/external networks
toward ports 22, 23, 80, 443 and 8080, matching the reconnaissance pattern reported
against compromised Japanese NVRs, routers and SDN controllers. A single source
repeatedly probing this exact port set within a short window is indicative of automated
scanning tooling rather than normal client traffic; downstream correlation should
flag sources hitting 3+ of these ports within a few minutes.
'
references:
- JPCERT TSUBAME Q3 2025 report - Compromised Japanese NVRs send malicious packets
author: Vorant
logsource:
category: network_connection
product: firewall
detection:
selection:
dst_port:
- 22
- 23
- 80
- 443
- 8080
direction: inbound
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_internal
fields:
- src_ip
- dst_ip
- dst_port
falsepositives:
- Legitimate internet-wide scanning services (Shodan, Censys) probing the same port
set for research purposes
- Vulnerability scanning performed by the organization's own authorized security assessment
tools
tags:
- attack.reconnaissance
- attack.t1595.002
level: low
Inbound Connection to Exposed Telnet or SSH Service on IoT-class Device
Detects inbound TCP connections to Telnet (23) or SSH (22) reaching a device that also exposes an HTTP(S) management interface, indicating an internet-facing NVR/router/SDN controller reachable via external remote services as described in the JPCERT report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound Telnet or SSH Reaching Internet-Facing IoT Management Device
id: 4533b44d-03c3-5e18-8e89-7337b46be9e5
status: experimental
description: 'Flags inbound connections to Telnet (23/tcp) or SSH (22/tcp) on hosts
that, within the same observation window, also received connections on HTTP/HTTPS/8080
management ports. This combination matches the profile of consumer/enterprise NVRs,
routers and SDN controllers exposed directly to the internet and targeted by mass
scanning and opportunistic exploitation as reported by JPCERT TSUBAME. Intended
to surface devices that should not have remote administrative services reachable
from untrusted networks.
'
references:
- JPCERT TSUBAME Q3 2025 report - Compromised Japanese NVRs send malicious packets
author: Vorant
logsource:
category: network_connection
product: firewall
detection:
selection_admin_ports:
dst_port:
- 22
- 23
direction: inbound
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection_admin_ports and not filter_internal
fields:
- src_ip
- dst_ip
- dst_port
falsepositives:
- Authorized remote administration or jump-host access to legitimately internet-exposed
appliances
- Managed service provider maintenance connections to customer NVR/router equipment
over Telnet/SSH
tags:
- attack.initial_access
- attack.t1133
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://blogs.jpcert.or.jp/en/2026/03/tsubame_overflow_2025-07-09.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free