Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet Ravie LakshmananApr 18, 2026IoT Security / Vulnerability Threat actors are exploiting security flaws in TBK DVR and end‑of‑life (EoL) TP-Link Wi-Fi routers to deploy Mirai-botnet variants on compromised devices, according to findings from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42. The attack targeting TBK DVR devices has been found to exploit CVE-2024-3721 (CVSS score: 6.3), a medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 digital video recording devices, to deliver a Mirai variant called Nexcorium. "IoT devices are increasingly prime targets for large-scale attacks due to their widespread use, lack of patching, and often weak security settings," security researcher Vincent Li said. "Threat actors continue exploiting known vulnerabilities to gain initial access and deploy malware that can persist, spread, and cause distributed denial-of-service (DDoS) attacks." This is not the first time the vulnerability has been exploited in the wild. Over the past year, the security issue has been leveraged to deploy a Mirai variant as well as a distinct, relatively new botnet called RondoDox. In September 2025, CloudSEK also disclosed details of a large-scale loader-as-a-service botnet that has been distributing RondoDox, Mirai, and Morte payloads through weak credentials and old flaws in routers, IoT devices, and enterprise apps. The attack activity outlined by Fortinet involves the exploitation of CVE-2024-3721 to obtain and drop a downloader script, which then launches the botnet payload based on the Linux system's architecture. Once the malware is executed, it displays a message stating "nexuscorp has taken control." "Nexcorium has a similar architecture to the Mirai variant, including XOR-encoded configuration table initialization, watchdog module, and DDoS attack module," the security vendor said. The malware also includes an exploit for CVE-2017-17215 to target Huawei HG532 devices in the network and incorporates a list of hard-coded usernames and passwords for use in brute-force attacks targeting the victim's hosts by opening a Telnet connection. If the Telnet login is successful, it attempts to obtain a shell, set up persistence using crontab and systemd service, and connect to an external server to await commands for launching DDoS attacks over UDP, TCP, and SMTP. Once persistence is established on the device, the malware deletes the original downloaded binary to evade analysis. "The Nexcorium malware displays typical traits of modern IoT-focused botnets, combining vulnerability exploitation, support for multiple architectures, and various persistence methods to sustain long-term access to infected systems," Fortinet said. "Its use of known exploits, such as CVE-2017-17215, along with extensive brute-force capabilities, underscores its adaptability and efficacy in increasing its infection reach." The development comes as Unit 42 said it detected active, automated scans and probes attempting to exploit CVE-2023-33538 (CVSS score: 8.8), a command injection vulnerability impacting EoL TP-Link wireless routers, albeit using a flawed approach that doesn't result in a successful compromise. It's worth noting that the security flaw was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog in June 2025. The vulnerability affects the following models - TL-WR940N v2 and v4 TL-WR740N v1 and v2 TL-WR841N v8 and v10 "Although the in-the-wild attacks we observed were flawed and would fail, our analysis confirms the underlying vulnerability is real," researchers Asher Davila, Malav Vyas, and Chris Navarrete said. "Successful exploitation requires authentication to the router's web interface." The attacks, in this case, attempt to deploy a Mirai-like botnet malware, with the source code featuring numerous references to the string "Condi." It also comes equipped with the ability to update itself with a newer version and act as a web server to spread the infection to other devices that connect to it. Given that the affected TP‑Link devices are no longer actively supported, users are advised to replace them with a newer model and ensure that default credentials are not used. "For the foreseeable future, the security landscape will continue to be shaped by the persistent risk of default credentials in IoT devices," Unit 42 said. "These credentials can turn a limited, authenticated vulnerability into a critical entry point for determined attackers." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  botnet, CISA, Command Injection, cybersecurity, ddos, Fortinet, iot security, mirai, TP-LINK, Vulnerability Trending News Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass AI Will Change Cybersecurity. Humans Will Define Its Success. A Lesson No Algorithm Can Teach The AI Arms Race – Why Unified Exposure Management Is Becoming a Boardroom Priority New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems New SparkCat Variant in iOS, Android Apps Steals Crypto Wallet Recovery Phrase Images Block the Prompt, Not the Work: The End of "Doctor No" BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware ⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access Popular Resources Get Full Visibility into Vendor and Internal Risk in One Platform Learn How to Block Breached Passwords in Active Directory Before Attacks Secure Your AI Systems Across the Full Lifecycle of Risks [Guide] Get Practical Steps to Govern AI Agents with Runtime Controls