Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

Threat actors are exploiting CVE-2024-3721 vulnerability in TBK DVR devices to deploy Mirai botnet variant called Nexcorium.

• •CVE-2024-3721 is a command injection vulnerability (CVSS 6.3) affecting TBK DVR-4104 and DVR-4216 devices used to deliver Nexcorium botnet
• •Nexcorium malware implements multiple persistence mechanisms including crontab, systemd service, and Telnet connections for lateral movement across networks
• •The botnet also exploits CVE-2017-17215 to target Huawei HG532 devices and uses hardcoded credentials for brute-force attacks
• •TP-Link routers are targeted with CVE-2023-33538 exploitation attempts, representing a separate threat vector affecting end-of-life devices

This summary was automatically generated by AI based on the original article and may not be fully accurate.