Nexcorium Mirai Variant Exploits TBK DVR Flaw to Build IoT DDoS Botnet

Fortinet and other reporting identified Nexcorium, a Mirai-derived malware strain targeting Internet of Things devices, particularly TBK DVR-4104 and DVR-4216 video recorder systems used with security cameras. The campaign exploits CVE-2024-3721, an OS command injection flaw, to run a downloader script that retrieves malware binaries for multiple Linux architectures. Fortinet linked the activity to a suspected actor it calls Nexus Team, citing the custom HTTP header X-Hacked-By: Nexus Team – Exploited By Erratic.

Once installed, Nexcorium uses classic Mirai-style scanner, watchdog, and attack modules, establishes persistence through mechanisms including init, rc.local, systemd, and cron, and spreads further through brute-force Telnet activity, default-password abuse, and exploitation of CVE-2017-17215 in Huawei HG532 devices. The malware performs self-checks, replication, and self-deletion to improve resilience and evasion, then connects to the command-and-control domain r3brqw3d[.]b0ats[.]top to receive instructions for DDoS operations, including UDP, TCP SYN, TCP ACK, SMTP, and VSE query floods.