Compromised Japanese NVRs send malicious packets
JPCERT TSUBAME sensors detected suspicious packets from compromised NVR devices and enterprise routers in Japan, with scanning activity targeting common ports observed globally from July-September 2025.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
JPCERT's TSUBAME honeypot network observed suspicious network traffic originating from compromised devices in Japan during Q3 2025, extending beyond previously reported TP-Link router infections. Investigation revealed packets transmitted from domestic NVR (Network Video Recorder) products deployed alongside enterprise routers and SDN controllers, all configured with identical port numbers across multiple IP addresses. The uniform configuration patterns and presence of prefecture name abbreviations suggest these systems were provisioned by a single systems integrator or service provider across multiple regions. JPCERT has attempted but not yet succeeded in contacting the affected organizations.
Comparative analysis between domestic and overseas TSUBAME sensors showed overseas sensors received higher packet volumes overall. Domestic sensor traffic peaked in July before declining through September, while overseas traffic dipped in August but rebounded in September. Across all sensor locations—Japan, North America, Europe, and other regions—scanning activity consistently targeted ports 22/TCP, 23/TCP, 80/TCP, 443/TCP, and 8080/TCP, indicating widespread reconnaissance campaigns against SSH, Telnet, HTTP, HTTPS, and alternative HTTP services. While no critical incidents were identified this quarter, JPCERT emphasizes the importance of continued vigilance against scanning activity and systematic device compromise.
Source reporting: https://blogs.jpcert.or.jp/en/2026/03/tsubame_overflow_2025-07-09.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs