Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO

216.73.217.98

Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO

· Published 04/06/2026 00:14 · Modified 04/06/2026 09:39

Essential information

Published: 04/06/2026 00:14
Modified: 04/06/2026 09:39
Source / Author: AlienVault
Confidence: 100/100
Report type(s): threat-report
Labels / Tags: botnet c0xmo ddos gafgyt python scanner
Tags: 2026-06-03 botnet c0xmo ddos gafgyt python scanner
Related entities: 5 vulnerabilities (cve), 18 indicators, 18 observables, 20 techniques (mitre), 2 malware, 2 others

Description

A new Gafgyt botnet variant named C0XMO has been discovered that spreads by exploiting a stack buffer overflow vulnerability in DD-WRT router firmware. Unlike earlier versions, this malware separates its lateral movement capabilities into a standalone Python script, enabling more efficient targeting of various system architectures including ARM, MIPS, PowerPC, and x86. The malware establishes persistence through cron jobs and shell profile modifications, eliminates competing botnets, and supports 19 different DDoS attack methods. Its scanner component performs weak-credential brute-force attacks on Telnet and SSH services while also exploiting multiple HTTP-based vulnerabilities and Android Debug Bridge unauthorized access. The malware connects to command-and-control infrastructure and demonstrates significantly more sophisticated architecture compared to traditional IoT botnets.