Nexus Team Exploit Header for TBK DVR (CVE-2024-3721)

Elgonad .@elgonad

•updated Apr 27, 2026•1•0•153

Detects HTTP requests containing the custom 'X-Hacked-By' header with the value 'Nexus Team . Exploited By Erratic', which is associated with the Nexus Team's exploitation of CVE-2024-3721 against TBK DVR devices. This rule specifically looks for the unique header pattern used by this threat actor.