New botnet exploits vulnerabilities in NVRs, TP-Link routers

A Mirai-derived botnet campaign active since at least September is exploiting an unpatched RCE in DigiEver DS-2105 Pro NVRs (via /cgi-bin/cgi_main.cgi command injection) and known router flaws (TP-Link CVE-2023-1389 and Teltonika CVE-2018-17532) to install multi-architecture malware (using XOR/ChaCha20 obfuscation), achieve persistence via cron jobs, and perform DDoS/spread operations; Akamai published IoCs and YARA rules to detect the activity.