New Nexcorium Botnet Exploits DVR Flaw to Launch Large-Scale IoT Cyberattacks

CyberDefender 6 mins0

The rapid expansion of Internet of Things (IoT) devices has introduced convenience at scale—but also a growing attack surface for cybercriminals. From smart cameras to digital video recorders (DVRs), many of these devices operate with weak security controls, outdated firmware, and minimal monitoring. This makes them ideal targets for botnet campaigns and distributed denial-of-service (DDoS) attacks.

A recent campaign analyzed by FortiGuard Labs highlights this risk, showcasing a new Mirai-based malware variant named Nexcorium. This threat leverages a critical vulnerability—CVE-2024-3721—in TBK DVR devices to infiltrate systems, establish persistence, and launch coordinated attacks.

Exploit traffic via CVE-2024-3721, Source : Fortinet

Understanding the Initial Exploit Chain

The infection begins with the exploitation of CVE-2024-3721, an OS command injection vulnerability in TBK DVR devices. Attackers manipulate parameters (mdb and mdc) to execute arbitrary commands remotely. Once exploited, a downloader script named “dvr” is deployed.

This script retrieves malware binaries targeting multiple architectures, including:

  • ARM
  • MIPS R3000
  • x86-64 (AMD64)

After download, the malware is granted full execution permissions (chmod 777) and executed with arguments that identify the compromised system.

A notable artifact in the attack is a custom HTTP header: X-Hacked-By: Nexus Team – Exploited By Erratic

This suggests attribution to a relatively unknown threat group referred to as “Nexus Team.”

Malware Architecture: Mirai Evolution

Nexcorium closely follows the architecture of traditional Mirai variants but introduces refinements in persistence and attack flexibility.

Core Components:

  • Watchdog Module – Ensures continuous execution and respawns processes if terminated
  • Scanner Module – Searches for vulnerable devices and attempts brute-force access
  • Attack Module – Executes DDoS commands received from a command-and-control (C2) server

The malware uses XOR encoding (keys like 0x13 and 0xFD) to obfuscate configuration data, including:

  • C2 server details
  • Exploit payloads
  • Credential lists
  • Attack commands

Propagation and Lateral Movement

Nexcorium expands its reach using two primary techniques:

1. Exploit Reuse

It incorporates older vulnerabilities like CVE-2017-17215 (Huawei HG532 routers), demonstrating how legacy flaws remain relevant in modern attacks.

2. Brute-Force Attacks

The malware contains a hard-coded credential list featuring common default usernames and passwords such as:

  • admin / admin123
  • root / password
  • guest / guest

Using Telnet connections, it attempts login and executes shell commands to verify access.

Persistence Mechanisms

Once inside a system, Nexcorium ensures long-term survival using multiple redundancy techniques:

  1. Init Configuration – Modifies /etc/inittab for auto-restart
  2. Startup Script Injection – Edits /etc/rc.local
  3. Systemd Service Creation – Adds persist.service for automatic execution
  4. Cron Jobs – Schedules recurring execution

Additionally, it relocates itself to /usr/local/bin/sysd and deletes its original binary to evade detection.

DDoS Capabilities

Nexcorium is designed for high-impact DDoS operations. It supports multiple attack vectors, including:

  • UDP Flood
  • TCP SYN / ACK Flood
  • SMTP Flood
  • TCP PSH / URG Flood
  • VSE Query Flood

The malware communicates with its C2 server (r3brqw3d.b0ats.top) to receive instructions and dynamically launch attacks. It can also terminate attacks or self-destruct upon command.

Our Opinion on the Nexcorium Threat Landscape

The emergence of Nexcorium reinforces a critical and ongoing issue in cybersecurity: IoT security remains fundamentally broken at scale. Despite years of high-profile botnet attacks like Mirai, many manufacturers still ship devices with default credentials, limited update mechanisms, and little to no built-in threat detection.

What makes this campaign particularly concerning is not just the exploitation of a new vulnerability (CVE-2024-3721), but the seamless integration of older exploits like CVE-2017-17215. This hybrid approach shows that attackers are optimizing efficiency—maximizing reach while minimizing development effort.

From a defensive standpoint, this signals a need for layered security:

  • Network-level monitoring for abnormal traffic
  • Strict credential policies
  • Segmentation of IoT devices from critical infrastructure
  • Continuous vulnerability patching

Organizations must also recognize that IoT devices are no longer “low-risk” endpoints. They are active participants in threat ecosystems.

CyberDefender