Mirai Botnet Variants Target TBK DVRs via CVE-2024-3721
Mirai botnet variants, including Nexcorium, are actively exploiting a command injection vulnerability (CVE-2024-3721) in TBK DVR devices. This flaw, rated medium severity, allows attackers to hijack these devices and integrate them into a DDoS botnet. The attacks also impact end-of-life TP-Link Wi-Fi routers, highlighting the ongoing risks associated with unpatched and unsupported IoT hardware.
This exploitation underscores a persistent problem: legacy and unsupported devices remain prime targets for botnet operators. Defenders must prioritize identifying and isolating these vulnerable endpoints. The calculus for attackers is simple: these devices are often unmonitored and unpatched, offering a low-risk, high-reward entry point for expanding their attack infrastructure.
What This Means For You
- If your organization utilizes TBK DVRs or end-of-life TP-Link routers, immediately audit your network for these devices. Isolate any identified devices and disconnect them from the internet. Prioritize patching or replacement of all end-of-life networking equipment and IoT devices to mitigate this command injection risk.
Related ATT&CK Techniques
🛡️ Detection Rules
1 rule · 6 SIEM formats1 detection rule mapped to MITRE ATT&CK. Sigma YAML is free — copy below.
Mirai Variant Command Injection via TBK DVR CVE-2024-3721
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2024-3721 | Vulnerability | CVE-2024-3721 |
Written by SCW Vulnerability Desk
Related Posts
Oracle's April CPU: 450 Patches, Over 300 Remote, Unauthenticated Flaws
Oracle has dropped its April Critical Patch Update (CPU), delivering a significant batch of 481 security fixes across 28 product families. Of particular concern are...
Microsoft Rushes Patches for Critical ASP.NET Core Privilege Escalation Flaw
Microsoft has issued out-of-band updates to address a critical privilege escalation vulnerability (CVE-2026-40372) in ASP.NET Core's Data Protection APIs. BleepingComputer reports that unauthenticated attackers could...
Mustang Panda's LOTUSLITE Variant Targets India Banks
The threat actor Mustang Panda has resurfaced with a new variant of its LOTUSLITE backdoor, specifically targeting India's banking sector. According to The Hacker News,...