Nexcorium Malware Targets IoT Devices, Utilizing Mirai Variant for DDoS Attacks

Key Takeaways

Nexcorium is a new, sophisticated malware derived from the Mirai strain, targeting IoT devices.
The malware mainly affects TBK DVR-4104 and DVR-4216 DVRs, exploiting a critical vulnerability.
Experts stress the importance of ongoing adversarial testing to enhance security beyond routine scans.

Emergence of Nexcorium Malware

Coverage from HackRead reveals that Nexcorium, a new threat in the cybersecurity landscape, poses considerable risks to smart devices worldwide. This advanced malware is a derivative of the infamous Mirai malware, specifically designed to create a botnet via the compromise of Internet of Things (IoT) devices. Its primary aim is to facilitate large-scale distributed denial of service (DDoS) attacks.

Nexcorium has a particular affinity for video recording devices, notably the TBK DVR-4104 and DVR-4216 models. These models are targeted due to their noted security vulnerabilities and lack of regular updates, making them easy prey for attackers. The malware exploits a command injection vulnerability identified as CVE-2024-3721, allowing unauthorized access to these devices where malicious code can be executed.

In terms of operational features, Nexcorium is compatible with multiple architectures, which increases its adaptability across different processors. Its design incorporates strong persistence mechanisms that include self-replication into various folders and automated task setups, complicating removal efforts for affected users.

Moreover, Nexcorium expands its influence by leveraging a comprehensive database of default passwords along with conducting brute-force attacks, allowing it to infiltrate other network-connected devices. This strategy aims to reinforce its botnet, thus enhancing its capacity to launch DDoS attacks that can impact wider networks.

In light of these developments, cybersecurity experts urge organizations to adopt continuous adversarial testing. This approach, which simulates real-world attacker behavior, is seen as critical for effectively identifying and mitigating risks associated with less frequently assessed devices—particularly those that might often be overlooked in standard security evaluations.

The content above is a summary. For more details, see the source article.