Attackers Exploit DVR Command Injection Flaw to Deploy Mirai-Based Botnet

FortiGuard Labs observed a Nexcorium campaign leveraging a command injection vulnerability (CVE-2024-3721) in TBK DVRs to download and execute a multi-architecture Mirai-based botnet (ARM, MIPS, x86-64). The malware uses XOR-encoded configuration containing C2 details and credentials for brute force, modifies startup files and cron jobs for persistence, includes legacy exploits like CVE-2017-17215 to expand reach, and supports a range of DDoS methods controlled via centralized C2; defenders are advised to prioritize IoT hygiene, agentless discovery, credential and firmware management.