A new variant of the Gafgyt botnet, tracked as C0XMO, is rapidly expanding its reach across multiple Linux architectures.
Discovered earlier this year, this malware initially breaches systems by exploiting CVE-2021-27137, a stack buffer overflow vulnerability found in the UPnP service of specific DD-WRT routers.
By sending specially crafted M-SEARCH requests over UDP port 1900, attackers can force a buffer overflow and download the primary payload directly into the compromised host’s temporary cache.
Gafgyt Targets Linux Architectures
Once executed on a compromised host, C0XMO immediately establishes deep persistence to ensure its long-term survival.
It creates multiple hidden directories across the system, copies itself into these stealthy locations, and modifies file permissions to guarantee execution privileges.
The malware further entrenches itself by setting up recurring cron jobs and appending execution commands to shell profile files, such as the user’s bash profile.
To maximize system resources for its own operations, C0XMO actively hunts down and eliminates rival malware.
It scans active system processes against an internal blocklist targeting competing botnets, network service applications, and popular red-team utilities.
If it finds a match, C0XMO immediately kills the process. It aggressively deletes the competitor’s executable files and persistence mechanisms, such as competing init scripts or system services.
After establishing a connection to the host, the malware establishes a custom handshake with its command-and-control server using specific hexadecimal magic values.
From there, the botnet node is primed to launch 19 different types of distributed denial-of-service attacks.
These capabilities range from standard TCP and UDP bypass floods to more specialized attacks like Memcached amplification, Discord voice UDP floods, and complex HTTP request storms.
According to Fortinet research, the most notable feature of C0XMO is its independent Python-based scanner, which drives its lateral movement.
The primary malware fetches this script from a remote server and forcibly installs required networking packages, such as requests and paramiko.
This scanner operates using multiple worker threads to identify and compromise new targets, checking internal blocklists to avoid scanning known honeypots or research institutions.
The scanner relies on a combination of weak-credential brute-forcing for SSH and Telnet services, along with a battery of automated HTTP-based exploits.
It actively targets several known vulnerabilities for initial access, including HNAP SOAP injections, GLPI htmLawed remote code execution, and AVTECH DVR flaws.
It also actively exploits unauthorized-access vulnerabilities in the Android Debug Bridge to compromise exposed mobile and Internet-of-Things devices.
Indicators of Compromise
| Indicator Type | Value | Description |
|---|---|---|
| IP / Port | 217[.]160[.]125[.]125:15527 | Scanner script distribution server / C2 |
| IP Address | 176[.]100[.]37[.]91 | Associated Malicious Host |
| IP Address | 85[.]215[.]131[.]70 | C0XMO Command-and-Control (C2) Server |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
