{
  "name": "Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO",
  "slug": "inside-the-cross-platform-propagation-of-a-new-gafgyt-variant-c0xmo",
  "description": "A new Gafgyt botnet variant named C0XMO has been discovered that spreads by exploiting a stack buffer overflow vulnerability in DD-WRT router firmware. Unlike earlier versions, this malware separates its lateral movement capabilities into a standalone Python script, enabling more efficient targeting of various system architectures including ARM, MIPS, PowerPC, and x86. The malware establishes persistence through cron jobs and shell profile modifications, eliminates competing botnets, and supports 19 different DDoS attack methods. Its scanner component performs weak-credential brute-force attacks on Telnet and SSH services while also exploiting multiple HTTP-based vulnerabilities and Android Debug Bridge unauthorized access. The malware connects to command-and-control infrastructure and demonstrates significantly more sophisticated architecture compared to traditional IoT botnets.",
  "published": "2026-06-03T22:14:23.758000+00:00",
  "created_at": "2026-06-04T09:39:10.147000+00:00",
  "modified_at": "2026-06-04T07:39:10+00:00",
  "created_at_opencti": "2026-06-04T09:39:10.147000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "botnet",
    "c0xmo",
    "ddos",
    "gafgyt",
    "python scanner"
  ],
  "tags": [
    "2026-06-03",
    "botnet",
    "c0xmo",
    "ddos",
    "gafgyt",
    "python scanner"
  ],
  "related_entities": {
    "vulnerabilities": [
      {
        "id": "cb317870-e4d3-4d8d-aa50-542b197dba02",
        "name": "CVE-2015-2051"
      },
      {
        "id": "997b2fba-4d4e-4534-90be-e26b157debd5",
        "name": "CVE-2021-27137"
      },
      {
        "id": "25a3a940-0e7b-4bb7-9856-3184ca9a5c19",
        "name": "CVE-2025-34054"
      },
      {
        "id": "8812cbe7-44a2-4253-87fe-3e4a9d86d20d",
        "name": "CVE-2016-15047"
      },
      {
        "id": "b8f0084a-b9d5-4475-be05-61f03a63304d",
        "name": "CVE-2022-35914"
      }
    ],
    "indicators": [
      {
        "id": "42642ecb-3546-4751-87dc-32c8fdfdf93c",
        "name": "217.160.125.125"
      },
      {
        "id": "88aa4ddf-91ee-42ef-b2d7-11b167475733",
        "name": "85.215.131.70"
      },
      {
        "id": "b270d86c-5360-4459-8d39-eb4a855ba0e2",
        "name": "444a9d34a9f59dc7975dfabefb47d789813a4497bbac9127c4806dd816e85211"
      },
      {
        "id": "47aadc4a-f910-4e30-b47c-e29261a38d08",
        "name": "8fc2d35b66c692d37a85ae9d30dc5c7f06f0b3eaf01112a5a6398a1a0feb3aee"
      },
      {
        "id": "d4dbdbc4-3873-4238-b2f0-3c2546bd4a14",
        "name": "dff0edae6e8854ddd3e617054ee0bd74c696c91411f704dff60aabaec839bec9"
      },
      {
        "id": "53b7d361-2203-4139-a621-8d4320bade4e",
        "name": "d452f22dacab9785539484245c13e9cce58df23fc82eeef205684fcd196da20b"
      },
      {
        "id": "92a70b17-239c-4b8e-aab3-948f88cb0c01",
        "name": "ea44138b9701fce1b2fe13de8f9e00681c007c9adc625edc9f507f177704c2e8"
      },
      {
        "id": "761aed3e-a7d3-41b1-88cf-d7435f2912d1",
        "name": "176.100.37.91"
      },
      {
        "id": "3055f6b9-c099-4d85-96b0-12649aa049f2",
        "name": "b61a5508847a2167b737d31193dc393e92c5be2aa5141bbe4b7ea6f440fd4799"
      },
      {
        "id": "5756e4e7-50fe-4670-a8b5-33175dbbe778",
        "name": "eead44c0af7ddb12cece1a6125cf213bab3c22511cd59aff9d63dcfddb7d4386"
      },
      {
        "id": "d24096bc-3d8f-4ebb-8e8c-08973c3f193a",
        "name": "9394666007fac4014a4641fdae150c1b969ed2bc4299876318a336fd386abf59"
      },
      {
        "id": "28e7d3e3-4818-4a81-88c8-dd252692be2c",
        "name": "450ea44da0c9d96a2e8f4d6bad34f1c35cd35743295b8cd2defa9f7a9884685d"
      },
      {
        "id": "751a0ec9-8ba6-405d-844a-3565c70d8b80",
        "name": "f02b1d8010dac35b007796def0cbd5d0c9414df790e2b55b105c95df2f2ffa91"
      },
      {
        "id": "df020d28-3f79-47c1-9820-871645d7c46d",
        "name": "41e8e327abbf2ba721be677ad8a416a7295708257b39688a0af03275fb199cec"
      },
      {
        "id": "b28fd886-aeac-4c0d-af98-110090240d92",
        "name": "b6f835ced11059d341222eba11fff3a4672f4de47a3a4d791fad86059a2b06d4"
      },
      {
        "id": "bc10e7e6-1935-4ea4-a063-aeb2407aa1ad",
        "name": "7413cbb6eab4d6b10346f71be5dd76d7cf2f4817f7776367b162f83755aefa1f"
      },
      {
        "id": "f24d3e51-e6f7-45d8-9565-4301d25096f9",
        "name": "3ddb67ab079509dd1e7ac77fc4cfed25a271526668c68f8a2221e96a4cc21812"
      },
      {
        "id": "fd00b580-0d8a-4d3d-828d-31441a0ed0a9",
        "name": "20042f1efb59c99e3addf822a3e9e5a496f0b701362df038a50a32a9f504a136"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "f65930b0-5581-4f3d-a367-a86ac78f407b",
        "name": "T1021.004"
      },
      {
        "id": "52279b3d-8158-4964-8c20-9094308fcd03",
        "name": "T1110.001"
      },
      {
        "id": "9e03cb7d-ae0e-49eb-97d3-438a535cc38f",
        "name": "T1037.004"
      },
      {
        "id": "747c7b95-79ff-4132-8ea5-397cb6665ebd",
        "name": "T1498"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "7671fe3e-6a85-463e-928d-16117d2f4f9b",
        "name": "T1059.006"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "9643a7e9-771b-4396-83a3-26fcec5200e4",
        "name": "T1021.006"
      },
      {
        "id": "820fbdf8-7db2-4292-9a60-7eed3567be8d",
        "name": "T1210"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "786b4ce4-6812-4b9b-b9e5-f9f05f7b35b9",
        "name": "T1595.001"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "53c193a7-f726-4bd2-ae88-4019e2604adf",
        "name": "T1046"
      },
      {
        "id": "19ce62bb-3faf-4d09-90b1-d82fce1ba8b0",
        "name": "T1136"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "e0204523-8122-4143-a774-7a3a1a81dc38",
        "name": "T1053.003"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "malware": [
      {
        "id": "4adbeaf6-33dd-452d-b741-38fcaaf1a384",
        "name": "C0XMO",
        "slug": "c0xmo"
      },
      {
        "id": "c57af675-ee48-42b3-ae28-0e9fd72fa076",
        "name": "Gafgyt",
        "slug": "gafgyt"
      }
    ],
    "observables": [
      {
        "id": "ba030bdf-91de-4a76-88d1-9ead0ba3c9a2",
        "name": "176.100.37.91"
      },
      {
        "id": "6ef6af3b-8831-44f7-bcbd-00cd6af3f1a3",
        "name": "217.160.125.125"
      },
      {
        "id": "cfd39ac5-3acd-4742-89be-ce2ebcabe7be",
        "name": "85.215.131.70"
      },
      {
        "id": "",
        "name": "444a9d34a9f59dc7975dfabefb47d789813a4497bbac9127c4806dd816e85211"
      },
      {
        "id": "",
        "name": "8fc2d35b66c692d37a85ae9d30dc5c7f06f0b3eaf01112a5a6398a1a0feb3aee"
      },
      {
        "id": "",
        "name": "dff0edae6e8854ddd3e617054ee0bd74c696c91411f704dff60aabaec839bec9"
      },
      {
        "id": "",
        "name": "d452f22dacab9785539484245c13e9cce58df23fc82eeef205684fcd196da20b"
      },
      {
        "id": "",
        "name": "ea44138b9701fce1b2fe13de8f9e00681c007c9adc625edc9f507f177704c2e8"
      },
      {
        "id": "",
        "name": "b61a5508847a2167b737d31193dc393e92c5be2aa5141bbe4b7ea6f440fd4799"
      },
      {
        "id": "",
        "name": "eead44c0af7ddb12cece1a6125cf213bab3c22511cd59aff9d63dcfddb7d4386"
      },
      {
        "id": "",
        "name": "9394666007fac4014a4641fdae150c1b969ed2bc4299876318a336fd386abf59"
      },
      {
        "id": "",
        "name": "450ea44da0c9d96a2e8f4d6bad34f1c35cd35743295b8cd2defa9f7a9884685d"
      },
      {
        "id": "",
        "name": "f02b1d8010dac35b007796def0cbd5d0c9414df790e2b55b105c95df2f2ffa91"
      },
      {
        "id": "",
        "name": "41e8e327abbf2ba721be677ad8a416a7295708257b39688a0af03275fb199cec"
      },
      {
        "id": "",
        "name": "b6f835ced11059d341222eba11fff3a4672f4de47a3a4d791fad86059a2b06d4"
      },
      {
        "id": "",
        "name": "7413cbb6eab4d6b10346f71be5dd76d7cf2f4817f7776367b162f83755aefa1f"
      },
      {
        "id": "",
        "name": "3ddb67ab079509dd1e7ac77fc4cfed25a271526668c68f8a2221e96a4cc21812"
      },
      {
        "id": "",
        "name": "20042f1efb59c99e3addf822a3e9e5a496f0b701362df038a50a32a9f504a136"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Japan"
      },
      {
        "id": "",
        "name": "Technology"
      }
    ]
  },
  "external_refs": [
    {
      "id": "f757e605-e29a-45b5-81ba-15b2012a05d1",
      "standard_id": "external-reference--06f29dba-d186-53a7-b93d-14e3c827ede7",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo",
      "hash": null,
      "external_id": null,
      "created": "2026-06-04T09:39:05.267Z",
      "modified": "2026-06-04T09:39:05.267Z",
      "createdById": null
    },
    {
      "id": "141a5faf-6bf4-4ba6-9675-c8feefadfc28",
      "standard_id": "external-reference--8cf19f79-e282-5219-bf30-2977946688f2",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a20a73f2ecb12c1ffd10df5",
      "hash": null,
      "external_id": "6a20a73f2ecb12c1ffd10df5",
      "created": "2026-06-04T09:39:05.238Z",
      "modified": "2026-06-04T09:39:05.238Z",
      "createdById": null
    }
  ]
}