Gafgyt Variant Targets Linux Architectures, IoT Devices

Key Takeaways

• A new variant of the Gafgyt botnet, named C0XMO, is actively exploiting known vulnerabilities in Linux-based devices, particularly DD-WRT routers and Android systems.
• C0XMO features a sophisticated modular design, enabling it to target multiple Linux processor architectures (ARM, MIPS, x86) and conduct lateral movement using Python scripts.
• The primary entry point is a stack buffer overflow (CVE-2021-27137) in the UPnP service of DD-WRT routers, but the botnet also leverages other CVEs for D-Link devices, GLPI project software, and Avtech DVR cameras.
• Once compromised, devices are recruited into a botnet capable of launching distributed denial-of-service (DDoS) attacks and expanding its footprint through continuous network scanning.
• Immediate patching of known vulnerabilities and disabling unnecessary services like UPnP are critical mitigation steps for individuals and organizations.

New Gafgyt Variant Targets Multiple Linux Architectures

A sophisticated new variant of the Gafgyt botnet, identified as C0XMO, is currently propagating, primarily targeting Linux-based devices and Internet of Things (IoT) infrastructure. This malware distinguishes itself through a modular architecture and its capacity to exploit a recognized vulnerability within DD-WRT router firmware to establish a foothold.

The core exploitation method involves a stack buffer overflow flaw present in the Universal Plug and Play (UPnP) service of vulnerable routers. This critical vulnerability allows attackers to gain complete control over affected devices without requiring any authentication credentials. Once a device is compromised, C0XMO immediately integrates it into its rapidly expanding botnet network.

Analysts at Fortinet’s FortiGuard Labs were instrumental in identifying and dissecting the C0XMO variant. Their detailed report indicates that the malware first emerged in March and has since been actively exploiting CVE-2021-27137. This specific vulnerability is a stack buffer overflow within the UPnP service of certain DD-WRT router firmware, triggered by sending an oversized ST:uuid value in a specially crafted M-SEARCH request over UDP port 1900.

What sets C0XMO apart from previous Gafgyt iterations is its advanced modular design, which enables it to target an extensive array of Linux processor architectures simultaneously. The attackers have engineered the malware to compile and deliver payloads tailored to specific architectures, significantly broadening its potential reach compared to many other IoT threats observed to date. Furthermore, it incorporates Python-based scanning scripts, facilitating lateral movement across networks and automated discovery of new targets.

The full extent of C0XMO’s impact is still under evaluation, but the threat is considerable due to the widespread deployment of DD-WRT firmware in both home offices and small businesses globally. The campaign extends beyond routers, with the malware also attempting to exploit exposed Android Debug Bridge (ADB) connections to compromise Android devices. This cross-platform approach highlights a growing sophistication among operators of IoT botnets.

Beyond its initial compromise, C0XMO is designed to launch distributed denial-of-service (DDoS) attacks once a device has been recruited into the botnet. Its exploit toolkit also includes vulnerabilities targeting D-Link devices (CVE-2015-2051), GLPI project software (CVE-2022-35914), and Avtech DVR cameras (CVE-2016-15047, CVE-2025-34054), dramatically expanding its potential attack surface. Security teams managing diverse device environments should consider this an active and persistent threat.

Multi-Architecture Propagation and Lateral Movement

A key technical innovation of C0XMO is its ability to separate lateral movement capabilities into a distinct Python script. This architectural choice provides the botnet with greater flexibility and makes it more challenging to detect, as it can scan and probe networks independently of the main malware binary. The script is responsible for identifying accessible hosts and determining the target’s processor architecture before deploying the appropriate compiled payload.

The malware targets a broad spectrum of Linux architectures, including ARM, MIPS, and x86, encompassing a wide range of devices such as routers, IoT sensors, and various embedded systems. For each identified architecture, C0XMO downloads and executes the correct compiled binary, allowing the botnet to expand across different hardware types within a single campaign. This modular, multi-architecture design, traditionally associated with more advanced threat actors, signals a significant escalation in the capabilities of IoT botnets.

Fortinet researchers observed that after successful infection, the malware establishes connections to a command-and-control (C2) server. From this C2, it awaits instructions for launching DDoS attacks and receiving further expansion orders. The continuous operation of scanning modules in the background ensures that new devices are identified, and their details are forwarded to the botnet operators. Brute-force authentication attempts against accessible services were also noted as a component of its network traversal routines.

What You Should Do

• Update Firmware Immediately: Prioritize applying the latest firmware updates for all routers, IoT devices, and embedded systems, especially those running DD-WRT, D-Link, GLPI, or Avtech products, to patch known vulnerabilities like CVE-2021-27137, CVE-2015-2051, CVE-2022-35914, and Avtech DVR camera flaws.
• Disable Unnecessary Services: Deactivate UPnP on DD-WRT routers if it is not essential for your network operations. This eliminates the primary entry point exploited by C0XMO.
• Implement Firewall Rules: Configure firewall rules to block external access to UDP port 1900, which is targeted by crafted M-SEARCH UPnP requests.
• Secure Android Debug Bridge (ADB): Ensure that ADB connections on Android devices are not exposed externally or left unsecured, as C0XMO exploits these for cross-platform propagation.
• Monitor Network Traffic: Actively monitor your network for unusual outbound connections, unexpected spikes in UDP traffic on port 1900, and repeated brute-force login attempts, which are indicators of potential compromise.
• Isolate and Patch Older Devices: Pay particular attention to older and unmanaged IoT devices, which are frequently unpatched and represent ideal targets for botnet campaigns. Consider isolating them on separate network segments or replacing them if they can no longer receive security updates.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.