Loading story…
Researchers reported that multiple Gafgyt/Bashlite variants targeting IoT devices are reusing leaked Mirai source code while continuing to evolve their infection and attack capabilities. Analyses found shared modules for HTTP, UDP, and TCP flooding, a telnet brute-force scanner, and other botnet functions, alongside exploitation of known router flaws including CVE-2017-17215, CVE-2014-8361, and CVE-2018-10561. Separate reporting also described campaigns abusing exposed SSH, Telnet, and WeMo UPnP services to drop first-stage shell scripts and architecture-specific ELF payloads that conscript devices into distributed denial-of-service operations.
Recent samples show operators tailoring payloads for stealth and persistence after compromise. One analyzed ELF binary, packed with UPX and masquerading as /usr/bin/apt, was observed beaconing to 45.61.186.4:13561, killing rival malware, flushing iptables, stopping local firewall services, clearing shell history, and altering DNS settings before accepting commands for TCP, UDP, GRE, ICMP, HTTP, and game-server-focused floods. Other reports noted process renaming, heavy forking, changing filenames and infrastructure, and added backdoor or cryptomining functions, indicating that Gafgyt operators are using modular, frequently modified malware to evade detection and sustain IoT-focused DDoS campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
In late September 2022, Nozomi Networks honeypots captured commonly abused default SSH and Telnet credentials such as admin:admin and root:root used in Gafgyt-related intrusion attempts.
On 2021-08-27, investigators found an IoT device accessing a malicious sample from a campaign tagged Korpze1233121337. CUJO AI analyzed the Gafgyt/Mirai-style fork and reported two newly observed DDoS modules, attacks_vector_openvpn_swak and attacks_vector_wabba_jack, along with Telnet-based propagation and C2 infrastructure at 103.161.17.233.
Belkin said the WeMo vulnerability discussed in Trend Micro's analysis had been detected and remediated for all affected devices in 2015.
Trend Micro noted that Bashlite, also known as Gafgyt, was previously known for large-scale distributed denial-of-service attacks in 2014.
SecurityScorecard analyzed a recently compiled, UPX-packed Gafgyt ELF sample that disguised itself as /usr/bin/apt, killed suspected Mirai processes, disabled local defenses, and connected to command-and-control server 45.61.186.4:13561.
Nozomi Networks documented Gafgyt variants ranging from feature-rich to lightweight samples, indicating campaign-specific tailoring or modular malware capabilities. The analysis described brute-force initial access, staged payload delivery, DDoS functions, and evasion features such as process renaming and forking.
Uptycs reported that some Gafgyt variants embedded exploits for CVE-2017-17215, CVE-2014-8361, and CVE-2018-10561 to compromise Huawei, Realtek, and GPON routers and fetch additional payloads.
Uptycs threat researchers detected several Gafgyt variants that reused Mirai botnet modules including HTTP, UDP, TCP, STD, and telnet brute-force functionality. The analysis reinforced Gafgyt's role as an IoT-focused DDoS botnet.
Trend Micro disclosed its findings on the updated Bashlite campaign to Belkin. Belkin responded by urging customers to update their devices and mobile apps to obtain the latest security fixes.
Trend Micro observed detections of updated Bashlite variants on March 21 across Taiwan, the United States, Thailand, Malaysia, Japan, and Canada. The campaign targeted devices exposing the WeMo UPnP API and added mining, backdoor, and bot-killing capabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
nozominetworks.com
Open sourcecujo.com
Open sourceuptycs.com
Open sourceblog.trendmicro.com
Open sourcesecurityscorecard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New variants of the **Mirai** and **Gafgyt** IoT/Linux botnets were observed expanding from consumer devices to enterprise-facing systems by exploiting known vulnerabilities in **Apache Struts** and **SonicWall Global Management System**. Palo Alto Networks Unit 42 reported that a Mirai sample targeted `CVE-2017-5638`, the remote code execution flaw in Apache Struts tied to the Equifax breach, marking the first known case of Mirai using that exploit in the wild. A Gafgyt variant was also seen exploiting `CVE-2018-9866` in older, unsupported SonicWall GMS versions shortly after a Metasploit module for the bug became public. Researchers linked both malware families through infrastructure involving **l[.]ocalhost[.]host** and said the Mirai sample carried 16 exploits in total, while the Gafgyt sample included scanning and DDoS capabilities such as **Blacknurse**, underscoring a broader shift by IoT/Linux botnets toward outdated enterprise targets.
Aug 14, 2026
Researchers reported multiple fast-moving IoT/Linux botnet campaigns built from **Mirai** and **Gafgyt** code that aggressively targeted embedded devices through known vulnerabilities and, in some cases, credential brute forcing. Palo Alto Networks said the campaigns—linked to evolutions of **Omni**, **Okane**, and **Hakai**—combined as many as 11 exploits in a single sample and introduced new distributed denial-of-service techniques, while related **Gafgyt** malware added an `HTTPCF` Layer 7 attack command aimed at Cloudflare-protected URLs. One newly adopted vector was the unauthenticated remote command execution flaw in **D-Link DSL-2750B** routers, which attackers incorporated shortly after public exploit tooling became available. The activity mirrors earlier reporting on **IoT_reaper**, a rapidly spreading botnet that also favored exploit-driven propagation over Mirai-style weak-password attacks. Netlab 360 said Reaper integrated at least nine exploits across products from **D-Link, Netgear, Linksys, AVTECH, GoAhead, JAWS,** and **Vacron**, maintained multiple command-and-control components, and at one point showed more than 10,000 daily active bot IPs on a tracked server, with millions of vulnerable devices queued for infection. Together, the reports show botnet operators quickly weaponizing public disclosures and modules to compromise internet-exposed routers and cameras at scale, then repurposing those infections for DDoS and broader botnet operations.
Aug 15, 2026
Researchers reported a new **Gafgyt** botnet variant, **C0XMO**, exploiting `CVE-2021-27137`, a stack buffer overflow in the UPnP service of vulnerable **DD-WRT** firmware, to compromise internet-exposed devices. The malware was observed in March targeting a Japanese technology company, with exploitation triggered through malicious SSDP `M-SEARCH` requests to UDP port `1900`. After compromise, C0XMO drops files into `/tmp/.cache`, establishes persistence through hidden copies, cron jobs, shell profile changes, and self-reexecution, and removes competing malware and rival persistence mechanisms. C0XMO expands on earlier Gafgyt activity with a modular design that separates scanning and lateral movement into a standalone Python script, improving propagation across mixed Linux environments and CPU architectures. Researchers said the malware supports multiple Linux builds, connects to a command-and-control server at `85[.]215[.]131[.]70` using a custom handshake, and can execute heartbeat, scanning, and **19 DDoS attack methods**. Its scanner, retrieved from `217[.]160[.]125[.]125:15527`, performs random internet scanning, brute-forces **Telnet** and **SSH**, exploits multiple HTTP flaws, and abuses exposed **ADB** services to deploy architecture-specific payloads, indicating broad cross-platform botnet expansion.
Jul 22, 2026