FortiGuard Labs analyzed a campaign exploiting CVE-2024-3721 in TBK DVR-4104 and DVR-4216 devices to install the multi-architecture Mirai variant Nexcorium, which uses downloader scripts, persistence tricks, brute-force login attempts, and DDoS modules. The activity is likely linked to the suspected “Nexus Team” threat actor, identified by a custom X-Hacked-By header and infrastructure including r3brqw3d[.]b0ats[.]top. #CVE-2024-3721 #Nexcorium #NexusTeam #TBKDVR-4104 #TBKDVR-4216 #r3brqw3d.b0ats.top

A critical pre-authentication bypass, CVE-2026-41940, was disclosed in cPanel/WHM and coincided with a sharp spike in hosts classified as malicious. Analysis indicates two active campaigns—post-compromise Mirai deployments and a large-scale file-encrypting campaign appending “.sorry” to files—heavily targeting cPanel systems. #CVE-2026-41940 #cPanel

A Mirai-based botnet campaign is actively exploiting CVE-2025-29635 in D-Link DIR-823X routers to execute commands via a POST to /goform/set_prohibiting and enlist devices. Akamai SIRT observed the activity in March 2026 and found attackers download and run a multi-architecture Mirai variant called "tuxnokill," while affected models reached end-of-life in November 2024, making vendor fixes unlikely. #CVE-2025-29635 #tuxnokill

Juniper Networks has issued an important alert about the Mirai botnet and its threats to Systematic Security Reporting (SSR) devices.

Juniper Networks has issued an important alert about the Mirai botnet and its threats to Systematic Security Reporting (SSR) devices.

 A command injection flaw in internet-connected digital video recorders used for CCTV monitoring is the target of a Mirai botnet malware variant, which allows hackers to take over the devices and add them to a botnet.  Cybersecurity researchers at Russian cybersecurity firm Kaspersky discovered a CVE-2024-3721 exploit while analysing logs from their Linux honeypot system. The issue is a command injection vulnerability found in internet-connected digital video recorders used for CCTV surveillance. Further analysis revealed that the activity was related to a form of the Mirai botnet, which exploited this issue in TBK-manufactured DVR devices to compromise and control them.  The vulnerability was initially discovered by security researcher "netsecfish" in April 2024. By adjusting parameters like mdb and mdc, the researcher released a proof-of-concept showing how a carefully designed post request to a specific URL can trigger shell command execution. Kaspersky confirmed that this precise technique is being utilised in the wild, with its Linux honeypots catching ongoing exploitation attempts linked to a Mirai botnet variant that uses netsecfish's proof-of-concept to compromise vulnerable DVRs.  Nearly a decade ago, an anonymous source made the Mirai source code available online. It continues to act as the foundation for other evolving botnet efforts. The variant aimed at DVR systems expands on Mirai's initial foundation with extra features such as RC4-based string obfuscation, checks to avoid virtual machine environments, and anti-emulation methods.  The exploit is used by the attackers to transmit a malicious ARM32 program to the target device, which then connects to a command-and-control server and joins the botnet. The infected device can be used to launch distributed denial-of-service attacks, forward malicious traffic, and engage in other malicious actions. This Mirai variation uses a basic RC4 technique to decode its internal strings, with the decryption key disguised using XOR. After decryption, the strings are saved in a global list and used throughout runtime. To evade analysis, the virus runs anti-virtualization and anti-emulation checks on active processes for indicators of environments such as VMware or QEMU. Last year, Netsecfish reported that around 114,000 DVR devices were vulnerable to CVE-2024-3721. Kaspersky estimates the figure to be closer to 50,000. The majority of infections associated with this Mirai variation are found in Brazil, Russia, Egypt, China, India, and Ukraine.

JSON in the DistributedAPI read more about Two Distinct Botnets Exploit Wazuh Server Vulnerability to Launch Mirai-Based Attacks

A new Mirai botnet variant exploits CVE-2024-3721 to hijack TBK DVR devices via command injection, risking massive IoT attacks. Stay protected

server and recruit the device to join the botnet swarm read more about New Mirai botnet infect TBK DVR devices via command injection flaw

released a proof-of-concept (PoC) read more about Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit

Urgent: Samsung MagicINFO 9 Server vulnerability (CVE-2024-7399) allows Mirai botnet deployment; update immediately! #Samsung #MiraiBotnet #Cybersecurity

security and infrastructure business discovered read more about Hackers Exploit Samsung MagicINFO GeoVision IoT Flaws to Deploy Mirai Botnet

Major surge in TVT DVR exploits linked to Mirai botnet. #MiraiBotnet #IoTsecurity #Cybersecurity

A significant spike in exploitation attempts targeting TVT NVMS9000 DVRs has been detected, peaking on April 3, 2025, with over 2,500 unique IPs scanning for vulnerable devices.

endpoint of Edimax devices read more about Unpatched Edimax Camera Flaw Exploited for Mirai Botnet Attacks Since Last Year

アカマイ・テクノロジーズは「2025年注目すべきサイバーセキュリティの動向」に関する説明会を開催した。プロダクト・マーケティング・マネージャーの中西一博氏は主に「Mirai Botnetの復活」をテーマとして取り上げた。

Vimar smart home devices and Neterbit routers read more about New Mirai botnet targets industrial routers with zero-day exploits

Mirai is scanning for poorly protected Session Smart routers

Mirai has given rise to a number of variations read more about Juniper Warns of Mirai Botnet Targeting SSR Devices with Default Passwords