{"id":33956,"date":"2020-03-21T02:57:01","date_gmt":"2020-03-21T02:57:01","guid":{"rendered":"http:\/\/29b6e916-b92e-4990-a981-4ccfbd6633d1"},"modified":"2020-03-21T02:57:01","modified_gmt":"2020-03-21T02:57:01","slug":"ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/","title":{"rendered":"DDoS botnets have abused three zero-days in LILIN video recorders for months"},"content":{"rendered":"<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet3.cbsistatic.com\/hub\/i\/2020\/03\/20\/f5e13081-922f-4ca7-90bf-2b21e2ac3e41\/world-map.png\" class alt=\"world map cyber globe ddos botnet\"><\/span><\/p>\n<p>At least three botnet operators have secretly exploited three zero-day vulnerabilities in LILIN digital video recorders (DVRs) for more than six months before the vendor finally patched the bugs last month, in February 2020.<\/p>\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/Digital_video_recorder\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">Digital video recorders<\/a> are devices installed on company networks that aggregate video feeds from local CCTV or IP camera systems and record it on various types of storage systems, like HDDs, SSDs, USB flash drives, or SD memory cards.<\/p>\n<p>Today, DVRs are just as ubiquitous in today&#8217;s IoT landscape as the security cameras they serve.<\/p>\n<p>Ever since the early 2010s, as CCTV solutions started to become popular all over the world, malware botnets have also begun targeting DVR systems.<\/p>\n<p>DVR devices running with factory-default credentials or with old and outdated firmware have been hacked and have had their resources and bandwidth abused to launch DDoS attacks. Various DVR brands have been the cannon fodder of hundreds of different IoT botnets.<\/p>\n<h3>LILIN zero-days exploited since August 2019<\/h3>\n<p>Last year in August, it was <a href=\"https:\/\/www.meritlilin.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">LILIN<\/a>&#8216;s turn to have its devices exploited by hackers.<\/p>\n<p><a href=\"https:\/\/blog.netlab.360.com\/multiple-botnets-are-spreading-using-lilin-dvr-0-day-en\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">In a blog post published yesterday<\/a>, the Netlab team at Chinese security firm Qihoo 360 said it detected three botnets utilizing zero-days in LILIN DVRs.<\/p>\n<ol>\n<li>A vulnerability in the NTPUpdate process lets attackers inject and run system commands<\/li>\n<li>Through the use of one of two hardcoded credentials (root\/icatch99 and report\/8Jg0SR8K50) an attacker can retrieve and modify a DVR&#8217;s config file, and then execute commands on the device when the FTP (File Transfer Protocol) server configuration is periodically synchronized.<\/li>\n<li>Similar to above, but via the NTP (Network Time Protocol) service.<\/li>\n<\/ol>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>Netlab says the first botnet to exploit one of the zero-days was the <a href=\"https:\/\/news.sophos.com\/en-us\/2018\/10\/22\/chalubo-botnet-wants-to-ddos-from-your-server-or-iot-device\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Chalubo botnet<\/a>, which began abusing the NTPUpdate vulnerability to take over LILIN DVRs starting late August last year.<\/p>\n<p>The second and third zero-days came under active exploitation in January this year. Netlab said it saw the <a href=\"https:\/\/blog.netlab.360.com\/tag\/fbot\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">FBot botnet<\/a> abusing the second and third zero-days to bolster its bot army.<\/p>\n<p>Two weeks after FBot, the <a href=\"https:\/\/blog.netlab.360.com\/the-botnet-cluster-on-185-244-25-0-24-en\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Moobot botnet<\/a> operator also began abusing the second zero-day, although not the third.<\/p>\n<p>Netlab didn&#8217;t say what the botnet operators were doing with the hijacked LILIN DVRs, but most of these botnets have a history of launching DDoS attacks and a history of acting as proxy networks and re-routing traffic for bad actors.<\/p>\n<p>Netlab researchers said they reached out to LILIN twice, first after the FBot attacks, and then after Moobot. Although it took almost a month, LILIN did eventually release <a href=\"https:\/\/www.meritlilin.com\/assets\/uploads\/support\/file\/M00158-TW.pdf\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">a firmware update<\/a>, along with mitigation advice.<\/p>\n<p>It will most likely take months &#8212; if not years &#8212; for the patch to make it to some devices. If there&#8217;s an Achilles&#8217; heel to today&#8217;s IoT landscape then it&#8217;s the fact that there&#8217;s no easy one-button-push to update firmware on most devices. Once shipped to customers, the vast majority of these systems remain unpatched until decommissioned.<\/p>\n<p>At the time of writing, more than 5,000 LILIN DVRs are connected to the internet.<\/p>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hackers first began exploiting the bug in August last year. LILIN patched the issue in February this year.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":33957,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-33956","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>DDoS botnets have abused three zero-days in LILIN video recorders for months 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DDoS botnets have abused three zero-days in LILIN video recorders for months 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-03-21T02:57:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/03\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"475\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"DDoS botnets have abused three zero-days in LILIN video recorders for months\",\"datePublished\":\"2020-03-21T02:57:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/\"},\"wordCount\":515,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/03\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/\",\"name\":\"DDoS botnets have abused three zero-days in LILIN video recorders for months 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/03\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png\",\"datePublished\":\"2020-03-21T02:57:01+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/03\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/03\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png\",\"width\":1000,\"height\":475},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DDoS botnets have abused three zero-days in LILIN video recorders for months\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DDoS botnets have abused three zero-days in LILIN video recorders for months 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/","og_locale":"en_US","og_type":"article","og_title":"DDoS botnets have abused three zero-days in LILIN video recorders for months 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-03-21T02:57:01+00:00","og_image":[{"width":1000,"height":475,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/03\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"DDoS botnets have abused three zero-days in LILIN video recorders for months","datePublished":"2020-03-21T02:57:01+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/"},"wordCount":515,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/03\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/","url":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/","name":"DDoS botnets have abused three zero-days in LILIN video recorders for months 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/03\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png","datePublished":"2020-03-21T02:57:01+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/03\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/03\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months.png","width":1000,"height":475},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ddos-botnets-have-abused-three-zero-days-in-lilin-video-recorders-for-months\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"DDoS botnets have abused three zero-days in LILIN video recorders for months"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/33956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=33956"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/33956\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/33957"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=33956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=33956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=33956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}