Nexcorium Mirai variant exploits TBK DVR flaw to launch DDoS attacks
2026-04-18T14:51:45Z•68f554168b2dad641ad20850953e0dfdf8bdc2c8c72865cb1fbb14364592f45d
Apache ActiveMQBlueHammerCISA KEVCVE-2026-34197CiscoDDoSDDoS‑for‑hireDraftKingsGrinexIdentity Services Engine (ISE) , Webex fixes (critical) , CookevIoT botnetMicrosoft DefenderMiraiNexcoriumOperation PowerOFFRedSunTBK DVRTP-LinkUnDefendZionSiphoncredential stuffingcryptocurrency heistprivilege escalationwater sectorzero-day
What happened
Feed of multiple high-impact security events: a Mirai variant named Nexcorium is exploiting a TBK DVR flaw and EOL TP‑Link routers to build DDoS botnets; three Microsoft Defender zero‑days (BlueHammer, RedSun, UnDefend) are being exploited to gain elevated privileges (two remain unpatched); Kyrgyz crypto exchange Grinex suspended operations after a $13.7M theft; DraftKings credential‑stuffing actor sentenced; international Operation PowerOFF disrupted 53 DDoS‑for‑hire domains and exposed ~3M criminal accounts; ZionSiphon malware targets Israeli water treatment systems; CISA added Apache Active
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 68f554168b2dad641ad20850953e0dfdf8bdc2c8c72865cb1fbb14364592f45d
- Enrichment time
- 2026-04-18T14:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.