A newly identified malware campaign has been observed exploiting a command injection flaw in digital video recorder (DVR) devices to deploy a Mirai-based botnet, according to analysis by FortiGuard Labs. The activity targets CVE-2024-3721 in TBK DVR systems, enabling attackers to gain access and install a multi-architecture Mirai variant malware known as Nexcorium. Fortinet researchers found that the attack begins with crafted requests abusing vulnerable parameters to execute a downloader script. This script retrieves malicious binaries tailored for different Linux environments, including ARM, MIPS and x86-64 systems, then executes them with elevated permissions. Evidence within the attack traffic includes a custom HTTP header referencing "Nexus Team," which analysts believe may point to…