Loading malware…
C0XMO is a Gafgyt botnet variant discovered in 2026 that targets Linux-based IoT and network devices, particularly routers running vulnerable DD-WRT firmware. It is primarily associated with distributed denial-of-service operations and distinguishes itself from older Gafgyt variants through a more modular architecture that separates propagation and lateral movement into a standalone Python component.
The malware has been observed exploiting CVE-2021-27137 in DD-WRT for initial compromise and also propagates through weak-credential attacks against Telnet and SSH services. Its auxiliary scanner supports additional exploit paths against internet-exposed devices and services, including HTTP-based exploitation and abuse of exposed Android Debug Bridge interfaces, allowing expansion beyond routers to other embedded and Linux-based systems. Operators deploy architecture-specific binaries across a broad range of processor types, enabling cross-platform propagation at scale.
After execution, C0XMO establishes persistence by copying itself to hidden locations, creating recurring scheduled execution, modifying shell startup profiles, and re-executing if terminated. It also performs aggressive host monopolization by identifying and killing competing malware and other interfering processes, then removing rival persistence mechanisms. Infected devices connect to command-and-control infrastructure using a custom handshake and can receive commands to maintain bot status, initiate or stop scanning, and launch attacks.
C0XMO supports at least 19 DDoS methods, including multiple UDP, TCP, SYN, ICMP, HTTP flood, and amplification techniques. The malware has been reported in activity targeting a technology-sector victim in Japan. Its combination of exploit-based propagation, brute-force expansion, persistence, and competitor suppression makes it a comparatively mature and operationally deliberate member of the Gafgyt ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
References include: 'c0xmo botnet spreads via DD-WRT router flaw' and 'inside cross-platform propagation of new Gafgyt variant c0xmo'.
The scanner also includes numerous HTTP-based exploits for initial access, including... HNAP SOAP Injection (CVE-2015-2051). | FortiGuard Labs discovered a new Gafgyt botnet variant, C0XMO, that spreads by exploiting CVE-2021-27137. Our analysis revealed that, unlike earlier versions, this malware separates its lateral movement into a standalone Python script.
The scanner also includes numerous HTTP-based exploits for initial access, including... AVTECH DVR Vulnerability (CVE-2025-34054, CVE-2016-15047). | FortiGuard Labs discovered a new Gafgyt botnet variant, C0XMO, that spreads by exploiting CVE-2021-27137. Our analysis revealed that, unlike earlier versions, this malware separates its lateral movement into a standalone Python script.
The scanner also includes numerous HTTP-based exploits for initial access, including... GLPI htmLawed RCE (CVE-2022-35914). | FortiGuard Labs discovered a new Gafgyt botnet variant, C0XMO, that spreads by exploiting CVE-2021-27137. Our analysis revealed that, unlike earlier versions, this malware separates its lateral movement into a standalone Python script.
The scanner also includes numerous HTTP-based exploits for initial access, including... AVTECH DVR Vulnerability (CVE-2025-34054, CVE-2016-15047). | FortiGuard Labs discovered a new Gafgyt botnet variant, C0XMO, that spreads by exploiting CVE-2021-27137. Our analysis revealed that, unlike earlier versions, this malware separates its lateral movement into a standalone Python script.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Для закрепления в системе малварь копирует себя в скрытые каталоги (например, /tmp/.sys, /var/tmp/.sys и /dev/shm/.sys), после чего создает cron-задачи, которые перезапускают процесс каждые 15 минут.
Дополнительно вредонос модифицирует стартовые шелл-скрипты, чтобы автоматически запускаться после каждой перезагрузки системы.
C0XMO copies itself to hidden paths at /tmp/.sys, /var/tmp/.sys, and /dev/shm/.sys...
It does so by deleting binaries and removing their persistence mechanisms, including cron jobs, init scripts, system services, and shell profile entries.
После этого малварь начинает поиск новых жертв, перебирая адреса в интернете и проверяя популярные порты (включая 22, 23, 80, 443, 7547, 8080, 8443 и 8888).
The malware scans all active processes in /proc, comparing their names to an internal blacklist.
Furthermore, C0XMO actively scans running processes to identify competitor botnet clients on the host, as well as red-team tools, programming tools, and network services that may interfere with its operation, and terminates them.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An IoT botnet described as a new Gafgyt variant that spreads via the DD-WRT router flaw CVE-2021-27137 and includes competitor-killing capability.
A botnet malware strain described in the references as a new Gafgyt variant that spreads via the DD-WRT router flaw and includes competitor-killing capability.
A new Gafgyt-derived IoT botnet variant that exploits vulnerable routers and other internet-connected devices, installs persistence, kills competing malware and tools, uses a separate Python-based scanner for propagation, and supports large-scale DDoS attacks including UDP, TCP, SYN, ICMP, NTP, and Memcached amplification.
Модульный вариант ботнета Gafgyt, нацеленный прежде всего на роутеры с прошивкой DD-WRT. Использует CVE-2021-27137 для первоначального заражения, загружает Python-скрипт для установки библиотек и дальнейшего сканирования, распространяется через SSH/Telnet brute force, закрепляется через скрытые каталоги, cron и стартовые shell-скрипты, удаляет конкурирующие ботнеты и инструменты, а затем получает команды с C2 для сканирования, управления зараженными устройствами и проведения DDoS-атак.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.