A newly observed variant of the Mirai botnet is actively exploiting CVE-2024-3721, a command injection vulnerability in TBK DVR-4104 and DVR-4216 digital video recorders, to conscript them into a growing botnet. Originally disclosed by researcher “netsecfish” in April 2024, the flaw allows attackers to execute shell commands via maliciously crafted POST requests. Kaspersky researchers detected this exploit in their Linux honeypots, where the malware delivers an ARM32 binary without prior architecture checks; an efficiency made possible by the DVRs’ uniform ARM32 support. Built on Mirai’s decade-old source code, this new variant introduces enhancements including RC4-encrypted strings with XOR obfuscation, anti-virtualization/emulation checks, and execution path verification to avoid detection. Once infected, devices are linked to a command-and-control (C2) server for use in distributed-denial-of-service (DDoS) attacks or proxying malicious traffic. Despite netsecfish’s earlier estimate of 114,000 vulnerable devices, Kaspersky found roughly 50,000 still exposed, with infections largely in China, India, Egypt, Ukraine, Russia, Turkey, and Brazil. Further complicating mitigation, these DVR models have been widely rebranded under various names, and it’s unclear whether TBK Vision has issued patches. The case underscores how quickly threat actors adopt public exploits and the need for timely updates or factory resets to prevent persistent compromise. Any device owners and administrators should ensure that they’ve upgraded to the latest version to prevent exploitation.