TL;DR: Fortinet researchers discovered Nexcorium, a Mirai-based botnet that's hijacking TBK surveillance DVRs through a command injection flaw (CVE-2024-3721). TBK has over 600,000 cameras and 50,000 recorders deployed worldwide, in banks, government buildings, and retail chains. The compromised devices still record footage normally. But in the background, they're launching DDoS attacks, brute-forcing other devices, and spreading through your network. The vulnerability has no patch. The devices rarely get firmware updates. If your organization uses TBK DVR-4104 or DVR-4216 systems, isolate them from the internet immediately.
The Attack
On April 17, 2026, Fortinet's FortiGuard Labs published its analysis of Nexcorium, a new variant of the Mirai botnet that specifically targets digital video recorders used in surveillance systems [1].
The malware exploits CVE-2024-3721, a command injection vulnerability in TBK DVR-4104 and DVR-4216 devices. These aren't consumer webcams. TBK markets its products to banks, government agencies, retail chains, and critical infrastructure operators. The company claims over 600,000 cameras and 50,000 recorders installed globally [2].
The attack is simple: Nexcorium sends a POST request to the DVR's management interface, injects a command, downloads a payload, and takes over the device. The entire process takes seconds. No user interaction required [3].
Once infected, the device displays "nexuscorp has taken control" in its console, not that anyone monitoring a DVR rack in a back office would notice [1].
What Happens After Infection
Nexcorium doesn't break the camera. That's the point. The surveillance footage keeps recording, the LEDs keep blinking, and the security team sees nothing wrong on their monitors. Meanwhile, the device is doing double duty.
Here's what the malware does on each compromised DVR:
- DDoS attacks: UDP and TCP flood attacks against whatever targets the botnet operators choose [1]
- Brute-force spreading: Scans for other devices on the network using a hardcoded list of 40+ default passwords, admin123, 12345, guest, the usual suspects [4]
- Lateral movement: Exploits CVE-2017-17215, a separate vulnerability in Huawei HG532 routers, to jump to other devices on the same network [1]
- Self-updating: Downloads newer versions of itself from command-and-control servers [1]
- Anti-forensics: Deletes its own binary after installation to avoid detection [3]
The malware installs persistence through four mechanisms: modifying /etc/inittab for auto-restart, updating /etc/rc.local for boot execution, creating a systemd service called persist.service, and adding cron jobs [1]. It's designed to survive reboots. Short of wiping the firmware entirely, it's staying put.
Why Surveillance DVRs Are Perfect Targets
Surveillance DVRs are the ideal botnet recruit. They're always on, always connected, rarely monitored at the OS level, and almost never patched.
Think about it: when was the last time your building's security team updated the firmware on the DVR in the server closet? Most organizations treat these boxes as appliances. Plug them in, connect the cameras, forget about them until a hard drive fails.
Kaspersky's Global Research and Analysis Team (GReAT) identified over 50,000 TBK DVR devices directly accessible from the internet [3]. That's 50,000 devices with management interfaces exposed to anyone who knows the IP address. And CVE-2024-3721 doesn't require authentication to exploit.
The geographic concentration tells you where the infrastructure is weakest: China, India, Egypt, Ukraine, Russia, Turkey, and Brazil [3]. But TBK sells globally, and plenty of devices are deployed in the US and EU under white-label brands, the same hardware, different sticker on the front.
The Irony: Surveillance Infrastructure as Attack Infrastructure
There's something darkly poetic about security cameras being used as weapons. The devices installed to watch people are now being conscripted into attacks against other systems. The same infrastructure that enables surveillance enables the compromise of other networks.
This isn't new. The original Mirai botnet in 2016 famously turned IP cameras and DVRs into an army that took down Dyn's DNS service, knocking Twitter, Netflix, Reddit, and CNN offline for hours. That attack peaked at 1.2 Tbps [5].
But Nexcorium is more sophisticated than the original Mirai. It uses XOR-encrypted configuration tables instead of plaintext C2 addresses. It checks for virtual machines and sandboxes before executing. It supports multiple architectures, ARM, MIPS, x86-64, so it can infect a wide range of Linux-based IoT devices, not just DVRs [1][3].
And it's not alone. CVE-2024-3721 has been exploited by at least two other botnets, ShadowV2 and RondoDox, throughout 2025 [1]. The vulnerability is well-known. There's still no patch from TBK.
No Patch. No Plans.
CVE-2024-3721 was assigned a CVSS score of 6.3, medium severity. That rating is misleading. A medium-severity bug that requires no authentication, can be exploited remotely, and has no patch available is effectively critical in the real world [2].
TBK has not released a firmware update for the affected DVR-4104 and DVR-4216 models. Given that these are older models, many of which may be end-of-life, a patch may never come. The same device that records your building's lobby footage could be attacking hospital networks or government systems right now.
Fortinet's Vincent Li noted that the malware is "multi-architecture" and the persistence mechanisms make it especially difficult to remove [4]. You can't just reboot the device and hope it's clean.
What to Do
Check Your DVR Hardware
Look for TBK DVR-4104 or DVR-4216 units. They may be white-labeled, check the model numbers on the device itself, not just the brand name on the front panel. These are commonly sold through security system integrators under different brands.
Remove Internet Access Immediately
These devices have no business being directly accessible from the internet. Put them behind a firewall. Block all inbound connections. If remote viewing is required, use a VPN, never expose the management interface directly.
Change Default Credentials
Nexcorium carries a list of 40+ default passwords. If your DVR still uses "admin/admin123" or "admin/12345," it will be compromised. Change the credentials even if you've firewalled the device, defense in depth.
Segment Your Network
Surveillance cameras and DVRs should be on an isolated VLAN with no access to your production network. If a DVR gets compromised, network segmentation prevents the malware from spreading to servers, workstations, and other critical systems.
Monitor for Unusual Traffic
A DVR generating large volumes of UDP or TCP traffic to external IPs is a red flag. Set up alerts for abnormal bandwidth usage from your surveillance network segment. Compromised DVRs participating in DDoS attacks will show obvious traffic spikes.
Plan for Replacement
If your TBK DVRs are end-of-life with no firmware updates available, start budgeting for replacements. No amount of network segmentation compensates for a device that will never be patched and is actively targeted by multiple botnets.
The Bigger Problem
Nexcorium is a symptom, not the disease. The disease is millions of surveillance devices running outdated Linux, connected to the internet, with default credentials, managed by organizations that don't think of cameras as computers.
But they are computers. They run Linux. They have network interfaces. They process data. And when they're compromised, they become weapons, capable of knocking websites offline, scanning networks, and spreading malware to everything else on your LAN.
The surveillance camera market is projected to hit 130 million units shipped annually by 2027. Most of those devices will never receive a firmware update after installation. Each one is a potential botnet soldier waiting for its draft notice.
Your security cameras are supposed to protect you. Right now, they might be attacking someone else.
References
- The Hacker News, Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet (April 18, 2026)
- Fortinet FortiGuard Labs, TBK DVRs Botnet Attack Outbreak Alert
- Kaspersky Securelist, New Mirai Botnet Campaign Targets DVR Devices (April 2026)
- Hackread, New Mirai Variant Nexcorium Hijacks DVR Devices for DDoS Attacks (April 2026)
- Security Affairs, Nexcorium Mirai Variant Exploits TBK DVR Flaw to Launch DDoS Attacks (April 18, 2026)
Published: April 19, 2026