Nexcorium-Associated Mirai Variant Uses TBK DVR Exploit to Scale Botnet Operations

FortiGuard Labs identified Nexcorium, a Mirai-like botnet actively exploiting CVE-2024-3721 in TBK DVR-4104 and DVR-4216 devices to install multi-architecture payloads (ARM, MIPS, x86-64) and build a DDoS botnet; the campaign (attributed to the 'Nexus Team') leverages legacy exploits (including CVE-2017-17215), Telnet brute-forcing, modular Mirai components, multiple persistence mechanisms, and communicates with C2 to launch varied flood attacks—mitigations recommended include patching CVE-2024-3721, replacing default credentials, and network segmentation of vulnerable IoT endpoints.