Mirai Strikes Again: Spring4Shell, Wazuh, and TBK DVRs Exploited in Live Campaigns

Daily Security Review

In this episode, we dive into the latest wave of active Mirai botnet campaigns exploiting high-severity remote code execution (RCE) vulnerabilities in critical enterprise and IoT systems. The Mirai malware—still evolving nearly a decade after its first appearance—has adapted its tactics to weaponize recent CVEs with CVSS scores of 9.8 and 9.9, impacting the Spring Framework (Spring4Shell), Wazuh SIEM, and TBK DVR devices.

We break down how attackers used Spring4Shell (CVE-2022-22965) to deploy web shells via Tomcat access logs, enabling remote code execution and malware downloads. Then we examine CVE-2025-24016 in Wazuh, where the unsafe use of Python’s eval() in its distributed API gave attackers direct system-level access via crafted payloads. Lastly, we cover CVE-2024-3721 in TBK DVRs, exploited through unauthenticated POST requests that install Mirai binaries equipped with anti-VM and string obfuscation to evade detection.

You’ll hear about:

• The technical mechanisms behind each exploit and how Mirai is being delivered.
• Real-world observations from Trend Micro, Akamai, and Kaspersky, including infection vectors and payload behaviors.
• Why DVRs, SIEMs, and Java-based frameworks remain high-value targets for botnets.
• Critical mitigation strategies, including API hardening, input sanitization, patch timelines, and anomaly detection.

Whether you’re a security analyst, incident responder, or system admin, this briefing gives you the situational awareness and practical defenses needed to address these active, high-impact threats.

🛡️ Don’t wait to patch. Mirai isn’t slowing down—and neither should your defense posture.