FortiGuard Labs has detected a significant increase in malicious network activity exploiting CVE-2024-3721, a critical unauthenticated command injection vulnerability affecting TBK DVR devices. FortiGuard’s global network of intrusion prevention system (IPS) sensors recorded over 60,000 detection events, indicating widespread and coordinated exploitation attempts. Our telemetry data reveals that multiple botnet operators are actively leveraging this vulnerability to expand their infrastructure. Notably, we have observed payloads and behaviors associated with Condi, Fodcha, Mirai, and Unstable botnet families- each known for targeting IoT devices to perform large-scale distributed denial-of-service (DDoS) attacks and establish persistent remote access. FortiGuard Labs continues to monitor this threat and will provide further intelligence as it becomes available. FortiGuard has previously released an Outbreak Alert for a different TBK vulnerability (CVE-2018-9995) exploited to spread Remote Access Trojan called HiatusRAT.