A new variant of the Mirai malware botnet is exploiting a command injection vulnerability (CVE-2024-3721) in TBK DVR-4104 and DVR-4216 digital video recording devices to hijack them. The flaw was disclosed by security researcher 'netsecfish' in April 2024. Kaspersky reports active exploitation of this vulnerability in its Linux honeypots, with the attackers using the exploit to drop an ARM32 malware binary that communicates with a command and control server. This enlists the device into the botnet swarm, likely used for DDoS attacks and proxying malicious traffic. Approximately 50,000 devices are exposed, with most infections seen in China, India, Egypt, Ukraine, Russia, Turkey, and Brazil.