{"id":233106,"date":"2026-04-18T02:01:00","date_gmt":"2026-04-18T06:01:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/18\/mirai-variant-nexcorium-exploits-cve-2024-3721-to-hijack-tbk-dvrs-for-ddos-botnet\/"},"modified":"2026-04-19T23:35:10","modified_gmt":"2026-04-20T03:35:10","slug":"mirai-variant-nexcorium-exploits-cve-2024-3721-to-hijack-tbk-dvrs-for-ddos-botnet","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/18\/mirai-variant-nexcorium-exploits-cve-2024-3721-to-hijack-tbk-dvrs-for-ddos-botnet\/","title":{"rendered":"Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet"},"content":{"rendered":"<p><a href=\"https:\/\/thehackernews.com\/2026\/04\/mirai-variant-nexcorium-exploits-cve.html\">Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet<\/a><\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/04\/mirai-variant-nexcorium-exploits-cve.html\">https:\/\/thehackernews.com\/2026\/04\/mirai-variant-nexcorium-exploits-cve.html<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-04-18 02:01:00<\/a><\/p>\n<p>Source Domain: <a href=\"thehackernews.com\">thehackernews.com<\/a><\/p>\n<p><span class=\"p-author\">\ue804<span class=\"author\">Ravie Lakshmanan<\/span>\ue802<span class=\"author\">Apr 18, 2026<\/span><\/span><span class=\"p-tags\">IoT Security \/ Vulnerability<\/span><\/p>\n<p>Threat actors are exploiting security flaws in TBK DVR and end\u2011of\u2011life (EoL) TP-Link Wi-Fi routers to deploy Mirai-botnet variants on compromised devices, according to findings from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42.<\/p>\n<p>The attack targeting TBK DVR devices has been found to exploit CVE-2024-3721 (CVSS score: 6.3), a medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 digital video recording devices, to deliver a Mirai variant called Nexcorium.<\/p>\n<p>&#8220;IoT devices are increasingly prime targets for large-scale attacks due to their widespread use, lack of patching, and often weak security settings,&#8221; security researcher Vincent Li said. &#8220;Threat actors continue exploiting known vulnerabilities to gain initial access and deploy malware that can persist, spread, and cause distributed denial-of-service (DDoS) attacks.&#8221;<\/p>\n<p>This is not the first time the vulnerability has been exploited in the wild. Over the past year, the security issue has been leveraged to deploy a Mirai variant\u00a0as well as a distinct, relatively new botnet called RondoDox. In September 2025, CloudSEK also disclosed details of a large-scale loader-as-a-service botnet that has been distributing RondoDox, Mirai, and Morte payloads through weak credentials and old flaws in routers, IoT devices, and enterprise apps.<\/p>\n<p>The attack activity outlined by Fortinet involves the exploitation of CVE-2024-3721 to obtain and drop a downloader script, which then launches the botnet payload based on the Linux system&#8217;s architecture. Once the malware is executed, it displays a message stating &#8220;nexuscorp has taken control.&#8221;<\/p>\n<p>&#8220;Nexcorium has a similar architecture to the Mirai variant, including XOR-encoded configuration table initialization, watchdog module, and DDoS attack module,&#8221; the security vendor said.<\/p>\n<p>The malware also includes an exploit for CVE-2017-17215 to target Huawei HG532 devices in the network and&#8230;<\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/04\/mirai-variant-nexcorium-exploits-cve.html\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet https:\/\/thehackernews.com\/2026\/04\/mirai-variant-nexcorium-exploits-cve.html Publish Date:&#8230;<\/p>\n","protected":false},"author":1,"featured_media":233107,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh6cxZZMfiWctk3Me9QO6UlzVRFab0SPGMTzThjpcPHCXm49bQ0rRvtG2W6gicJw4Mi1QUuv-yTDMK5GKJju3QicyjYJwdbA86Ok8w2oU5Vg28l4s0HAVv7_c03dStaM7OPd4Yq0khmm9MeQVUYnCYThMx4JvkCnZZ5PEtCXAA90vKfsAumsMAIw085JIsz\/s1600\/botnet-ddos.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[31,32,27],"class_list":["post-233106","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-exploit","tag-malware","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/233106"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=233106"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/233106\/revisions"}],"predecessor-version":[{"id":233108,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/233106\/revisions\/233108"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/233107"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=233106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=233106"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=233106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}