Hackers Use CVE-2024-3721 to Infect TBK DVRs With Nexcorium DDoS Malware

A Mirai-derived botnet named Nexcorium is actively exploiting TBK DVR models (CVE-2024-3721) and legacy TP-Link routers (CVE-2017-17215) to recruit devices into a DDoS-capable botnet; the campaign leverages unauthenticated RCE via a vulnerable endpoint, architecture-specific downloader binaries, persistence mechanisms (watchdog, self-copying with FNV-1a checks), and aggressive Telnet brute-forcing with default credentials, creating a large, hard-to-filter attack infrastructure.