FortiGuard Details C0XMO Gafgyt Botnet’s Cross-Platform Propagation
Summary
FortiGuard Labs analyzes C0XMO, a Gafgyt variant that exploits a DD-WRT UPnP flaw and uses a separate Python scanner to target Linux and IoT devices. The report details its persistence, C2, and DDoS capabilities.
Key points
- C0XMO exploits CVE-2021-27137, a stack buffer overflow in the UPnP service of vulnerable DD-WRT firmware.
- A separate Python scanner targets devices through Telnet and SSH brute-force attempts, HTTP exploits, and exposed Android Debug Bridge services.
- The malware persists through hidden self-copies, cron jobs, shell profile changes, and re-execution.
- C0XMO terminates competing processes and attempts to remove rival botnet files and persistence mechanisms.
- Its custom C2 handshake supports commands including scanning and 19 DDoS methods.
- FortiGuard recommends updating affected devices, disabling unnecessary Telnet and UPnP access, strengthening credentials, and monitoring for suspicious outbound scanning.
Article Details
- Attack Vectors
- C0XMO spreads by exploiting CVE-2021-27137, a stack buffer overflow in the UPnP service of vulnerable DD-WRT firmware; the article identifies affected changesets as before 45723.
- A separate Python scanner performs weak-credential login attempts against Telnet and SSH, then downloads and executes an architecture-matched payload after successful access.
- The scanner attempts HTTP-based exploitation, including UPnP SOAP injection, HNAP SOAP injection, command injection, and vulnerabilities affecting GLPI and AVTECH DVRs.
- The scanner also targets exposed Android Debug Bridge services and randomly scans public IP addresses on specified ports.
- Defensive Notes
- Update affected network devices and IoT systems to the latest firmware.
- Disable unnecessary remote-access services, including Telnet and UPnP, and enforce robust credential policies.
- Monitor for suspicious outbound scanning and exploitation attempts, and regularly audit internet-facing services.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 176[.]100[.]37[.]91 | Listed as a host IOC in the report; its specific role is not stated. |
| IPV4 | 217[.]160[.]125[.]125 | Server used to distribute the C0XMO binary and scanner script. |
| IPV4 | 85[.]215[.]131[.]70 | C0XMO command-and-control server. |
| SHA256 | 20042f1efb59c99e3addf822a3e9e5a496f0b701362df038a50a32a9f504a136 | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | 3ddb67ab079509dd1e7ac77fc4cfed25a271526668c68f8a2221e96a4cc21812 | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | 41e8e327abbf2ba721be677ad8a416a7295708257b39688a0af03275fb199cec | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | 444a9d34a9f59dc7975dfabefb47d789813a4497bbac9127c4806dd816e85211 | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | 450ea44da0c9d96a2e8f4d6bad34f1c35cd35743295b8cd2defa9f7a9884685d | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | 7413cbb6eab4d6b10346f71be5dd76d7cf2f4817f7776367b162f83755aefa1f | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | 8fc2d35b66c692d37a85ae9d30dc5c7f06f0b3eaf01112a5a6398a1a0feb3aee | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | 9394666007fac4014a4641fdae150c1b969ed2bc4299876318a336fd386abf59 | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | b61a5508847a2167b737d31193dc393e92c5be2aa5141bbe4b7ea6f440fd4799 | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | b6f835ced11059d341222eba11fff3a4672f4de47a3a4d791fad86059a2b06d4 | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | d452f22dacab9785539484245c13e9cce58df23fc82eeef205684fcd196da20b | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | dff0edae6e8854ddd3e617054ee0bd74c696c91411f704dff60aabaec839bec9 | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | ea44138b9701fce1b2fe13de8f9e00681c007c9adc625edc9f507f177704c2e8 | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | eead44c0af7ddb12cece1a6125cf213bab3c22511cd59aff9d63dcfddb7d4386 | SHA-256 hash listed for a reported C0XMO sample. |
| SHA256 | f02b1d8010dac35b007796def0cbd5d0c9414df790e2b55b105c95df2f2ffa91 | SHA-256 hash listed for a reported C0XMO sample. |
MITRE ATT&CK
T1021.004 · SSHThe scanner uses successful SSH logins to access targets and deploy the C0XMO payload.T1036 · MasqueradingC0XMO copies itself to hidden-looking paths such as /tmp/.sys, /var/tmp/.sys, and /dev/shm/.sys.T1053.003 · CronC0XMO creates cron jobs to relaunch itself every 15 minutes.T1059.006 · PythonThe scanner's lateral-movement capability is implemented as a standalone Python script that C0XMO executes.T1105 · Ingress Tool TransferC0XMO downloads the scanner script, and the scanner downloads architecture-matched payloads to compromised targets.T1110.001 · Password GuessingThe scanner attempts weak-password logins against Telnet and SSH services.T1210 · Exploitation of Remote ServicesThe scanner attempts HTTP-based and ADB exploitation to compromise remote devices.T1499 · Endpoint Denial of ServiceC0XMO supports DDoS methods including SYN floods, HTTP floods, and amplification attacks.T1547.001 · Registry Run Keys / Startup FolderC0XMO appends execution commands to shell startup files including ~/.profile, ~/.bashrc, and ~/.bash_profile.
CVE
CVE-2015-2051dlink · dir-645; dlink · dir-645_firmwareHNAP SOAP Injection (CVE-2015-2051)CVE-2016-15047Vendor / Product unavailableAVTECH DVR Vulnerability (CVE-2025-34054, CVE-2016-15047)CVE-2021-27137DD-WRT · DD-WRTFortiGuard Labs analyzed C0XMO, a modular Gafgyt botnet variant that exploits CVE-2021-27137 on vulnerable DD-WRT routers and uses a separate Python scanner to expand infections across Linux and IoT devices.CVE-2022-35914Glpi-project · GlpiGLPI htmLawed RCE (CVE-2022-35914)CVE-2025-34054Vendor / Product unavailableAVTECH DVR Vulnerability (CVE-2025-34054, CVE-2016-15047)
Malware
C0XMOFortiGuard Labs analyzed C0XMO, a modular Gafgyt botnet variant that exploits CVE-2021-27137 on vulnerable DD-WRT routers and uses a separate Python scanner to expand infections across Linux and IoT devices.GafgytFortiGuard Labs analyzed C0XMO, a modular Gafgyt botnet variant that exploits CVE-2021-27137 on vulnerable DD-WRT routers and uses a separate Python scanner to expand infections across Linux and IoT devices.
Vendors
Products
DD-WRTFortiGuard Labs analyzed C0XMO, a modular Gafgyt botnet variant that exploits CVE-2021-27137 on vulnerable DD-WRT routers and uses a separate Python scanner to expand infections across Linux and IoT devices.FortiClientThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.FortiEDRThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.FortiMailThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.Fortinet FortiGateThe FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR.