TBK DVR Vulnerability CVE-2024-3721 Exploited to Spread Nexcorium DDoS Malware

FortiGuard Labs reports active exploitation of CVE-2024-3721 in TBK DVR devices to deploy "Nexcorium", a Mirai-based multi-architecture botnet that uses a remote command-injection vector to install a multi-arch payload via a 'dvr' installer, employs persistence (inittab, rc.local, systemd service, cron), brute-force Telnet login, and offers diverse DDoS capabilities; observed IoCs include the custom HTTP header 'X-Hacked-By:Nexus Team – Exploited By Erratic' and C2 domain r3brqw3d.b0ats.top. Organizations are advised to patch affected devices, disable unnecessary services like Telnet, and monitor network traffic for signs of compromise.