C0XMO Botnet Exploits DD-WRT Flaw, Spreads Across Devices and Removes Rival Malware
Summary
Fortinet researchers say C0XMO, a modular Gafgyt variant, exploits CVE-2021-27137 and weak SSH/Telnet credentials to spread across routers and other devices. It supports 19 DDoS methods and removes competing tools and botnet clients.
Key points
- Fortinet researchers identified C0XMO as a modular Gafgyt variant with samples for multiple CPU architectures.
- The botnet targets DD-WRT routers and exploits the unauthenticated buffer overflow CVE-2021-27137.
- A Python scanner searches internet-facing systems, brute-forces weak SSH and Telnet credentials, identifies device architectures, and deploys compatible binaries.
- C0XMO persists by copying itself to hidden directories, creating cron jobs that relaunch it every 15 minutes, and modifying shell startup files.
- It searches for and terminates competing botnet clients, red-team tools, and other processes by removing binaries and persistence mechanisms.
- C0XMO connects to a command-and-control server using a multi-stage handshake and supports 19 DDoS methods.
- The article recommends updating devices, using unique administrator credentials, and disabling remote access when it is not needed.
Article Details
- Attack Vectors
- C0XMO exploits CVE-2021-27137, an unauthenticated buffer overflow affecting DD-WRT routers, to execute arbitrary code.
- A scanner randomly probes internet-facing systems and attempts to brute-force weak SSH and Telnet credentials before deploying a compatible C0XMO binary.
- C0XMO downloads a Python scanning script and uses it to scan for targets and exploit HTTP- and ADB-based vulnerabilities.
- The malware connects to a hardcoded command-and-control address and can receive commands to scan or launch DDoS attacks.
- On infected hosts, C0XMO removes competing botnet clients and other selected tools, along with their binaries and persistence mechanisms.
- Defensive Notes
- Keep devices up to date.
- Use unique administrator credentials.
- Disable remote access capabilities when they are not needed.
MITRE ATT&CK
T1021 · Remote ServicesAfter finding a target, the malware uses SSH or Telnet access with guessed credentials to deploy a compatible C0XMO binary.T1046 · Network Service DiscoveryThe scanner probes internet-facing systems on common ports, including SSH, Telnet, HTTP, and HTTPS.T1053.003 · CronC0XMO creates cron jobs that relaunch the malware every 15 minutes.T1057 · Process DiscoveryC0XMO scans running processes to identify competing botnet clients, tools, and services.T1059.006 · PythonThe downloaded Python script performs scanning, exploitation, architecture detection, and SSH/Telnet login tasks.T1105 · Ingress Tool TransferC0XMO downloads a Python scanner script for wider distribution and lateral movement.T1110.001 · Password GuessingThe scanner attempts to brute-force weak SSH and Telnet credentials on discovered systems.T1190 · Exploit Public-Facing ApplicationC0XMO exploits the unauthenticated CVE-2021-27137 buffer overflow in DD-WRT routers to execute arbitrary code.T1489 · Service StopThe malware terminates selected competing processes and removes binaries and persistence mechanisms, including services and cron jobs.T1498.001 · Direct Network FloodC0XMO supports direct DDoS methods including UDP, TCP, SYN, and ICMP floods.T1498.002 · Reflection AmplificationC0XMO supports NTP and Memcached amplification attacks.T1546.004 · Unix Shell Configuration ModificationThe malware modifies shell startup files to enable automatic execution.T1564.001 · Hidden Files and DirectoriesC0XMO copies itself into hidden directories such as /tmp/.sys, /var/tmp/.sys, and /dev/shm/.sys.
CVE
Malware
C0XMOFortinet researchers uncovered C0XMO, a new and more modular Gafgyt botnet variant that targets DD-WRT routers and can spread across many CPU architectures and device types.GafgytFortinet researchers uncovered C0XMO, a new and more modular Gafgyt botnet variant that targets DD-WRT routers and can spread across many CPU architectures and device types.