Loading story…
Researchers reported a new Gafgyt botnet variant, C0XMO, exploiting CVE-2021-27137, a stack buffer overflow in the UPnP service of vulnerable DD-WRT firmware, to compromise internet-exposed devices. The malware was observed in March targeting a Japanese technology company, with exploitation triggered through malicious SSDP M-SEARCH requests to UDP port 1900. After compromise, C0XMO drops files into /tmp/.cache, establishes persistence through hidden copies, cron jobs, shell profile changes, and self-reexecution, and removes competing malware and rival persistence mechanisms.
C0XMO expands on earlier Gafgyt activity with a modular design that separates scanning and lateral movement into a standalone Python script, improving propagation across mixed Linux environments and CPU architectures. Researchers said the malware supports multiple Linux builds, connects to a command-and-control server at 85[.]215[.]131[.]70 using a custom handshake, and can execute heartbeat, scanning, and 19 DDoS attack methods. Its scanner, retrieved from 217[.]160[.]125[.]125:15527, performs random internet scanning, brute-forces Telnet and SSH, exploits multiple HTTP flaws, and abuses exposed ADB services to deploy architecture-specific payloads, indicating broad cross-platform botnet expansion.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In March 2026, researchers identified a new Gafgyt botnet variant named C0XMO exploiting CVE-2021-27137 in vulnerable DD-WRT firmware. The activity was observed targeting a Japanese technology company, and analysis showed the malware used a separate Python script for lateral movement and supported multiple Linux architectures.
CVE-2026-45727 was published for the CloakBrowser path traversal vulnerability, describing how the fingerprint parameter could be abused to force profile paths outside the configured data directory. The disclosure noted the issue affected versions prior to 0.3.28 and had been patched in 0.3.28.
A GitHub security advisory disclosed an unauthenticated path traversal vulnerability in CloakBrowser's cloakserve CDP multiplexer affecting versions up to 0.3.27. The advisory said the issue could lead to arbitrary directory deletion and that it was fixed in version 0.3.28.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcesecurityonline.info
Open sourcesecurityaffairs.com
Open sourcexakep.ru
Open sourcefortinet.com
Open sourcefeeds.fortinet.com
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that multiple **Gafgyt/Bashlite** variants targeting IoT devices are reusing leaked **Mirai** source code while continuing to evolve their infection and attack capabilities. Analyses found shared modules for **HTTP, UDP, and TCP flooding**, a telnet brute-force scanner, and other botnet functions, alongside exploitation of known router flaws including `CVE-2017-17215`, `CVE-2014-8361`, and `CVE-2018-10561`. Separate reporting also described campaigns abusing exposed **SSH**, **Telnet**, and **WeMo UPnP** services to drop first-stage shell scripts and architecture-specific ELF payloads that conscript devices into distributed denial-of-service operations. Recent samples show operators tailoring payloads for stealth and persistence after compromise. One analyzed ELF binary, packed with **UPX** and masquerading as `/usr/bin/apt`, was observed beaconing to `45.61.186.4:13561`, killing rival malware, flushing `iptables`, stopping local firewall services, clearing shell history, and altering DNS settings before accepting commands for **TCP, UDP, GRE, ICMP, HTTP, and game-server-focused floods**. Other reports noted process renaming, heavy forking, changing filenames and infrastructure, and added backdoor or cryptomining functions, indicating that Gafgyt operators are using modular, frequently modified malware to evade detection and sustain IoT-focused DDoS campaigns.
Aug 15, 2026
The **Mozi** botnet infected routers, gateways, DVRs, NVRs, and other IoT devices through weak Telnet credentials and known vulnerabilities, then used a **DHT-based peer-to-peer** architecture to spread malware and maintain command-and-control without relying on centralized servers. Researchers said Mozi reused some Gafgyt code but stood apart for its decentralized design, XOR obfuscation, and **`ECDSA384`** signature checks that protected botnet configuration integrity. Infected devices could be directed to launch **DDoS** attacks, download and execute payloads, collect system information, and run arbitrary commands, while compromised nodes also hosted malware for further propagation over HTTP on random ports. Later analysis showed Mozi evolving beyond basic botnet activity by adding persistence mechanisms on **Netgear, Huawei, and ZTE** gateways, including startup-script changes, credential modification, service disabling, and port blocking. Microsoft reported the malware could also support **man-in-the-middle** activity such as DNS spoofing and HTTP session hijacking, raising the risk that compromised edge devices could become entry points into enterprise IT and OT networks. Netlab and other researchers found that even after action against its operators and a slowdown in updates, Mozi’s decentralized network continued to sustain lingering infections, while newer variants added Mirai-style C2 logic for DDoS coordination, UPnP port mapping, and additional node roles tied to mining activity.
Aug 15, 2026
Researchers reported renewed **Moobot** activity as operators updated infrastructure and scanned for exploitable internet-facing devices, especially **Tenda routers**, while continuing a broader pattern of targeting networking gear and embedded systems. Alien Labs linked the latest activity to a Mirai-derived botnet probing for known flaws including `CVE-2014-8361`, `CVE-2017-17215`, `CVE-2018-14558`, and `CVE-2020-10987`. Earlier reporting described Moobot as an active DDoS botnet that spread through weak Telnet credentials and exploits affecting routers, DVRs, IP cameras, GPON devices, ThinkPHP, and Android Debug Bridge, with operators using obfuscation, modified packers, DNS TXT-based command-and-control delivery, and proxy infrastructure including SOCKS and Tor to complicate analysis. Separate campaigns showed the botnet repeatedly shifting to new device classes and vulnerabilities to grow its node base. Unit 42 documented MooBot exploiting four **D-Link** router flaws — `CVE-2015-2051`, `CVE-2018-6530`, `CVE-2022-26258`, and `CVE-2022-28958` — to fetch shell-script droppers and architecture-specific binaries, while Netlab 360 and CNCERT reported exploitation of a zero-day command-injection flaw in **UNIX CCTV DVR/NVR** devices through port `8000`, affecting about **6,000** exposed systems. Across the campaigns, the malware retained core Mirai traits, including embedded credentials, persistence, and DDoS capability, while variants such as `Moobot_xor` and `Moobot_leet` introduced altered encryption keys, encrypted resources, and Tor-based C2 channels.
Aug 15, 2026