Nexcorium Mirai variant exploits TBK DVR flaw to launch DDoS attacks

Fortinet researchers observed a Mirai-derived malware family called Nexcorium actively exploiting CVE-2024-3721 in TBK DVRs (and targeting outdated TP-Link routers) to deploy multi-architecture binaries and grow a DDoS botnet. Nexcorium uses XOR-encoded configuration, embedded exploits (including CVE-2017-17215), brute-force Telnet credential lists, and multiple persistence mechanisms to maintain long-term access and conduct UDP/TCP flood attacks; the campaign shows real-world exploitation and reuse of known IoT vulnerabilities.