C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
A new C0XMO botnet variant exploits a DD-WRT flaw, spreads across many device types, and kills competing malware on infected hosts.
Intelligence analysis by GPT-5.4 Mini
Fortinet says the C0XMO botnet is a more advanced Gafgyt variant that uses a DD-WRT router flaw to spread, brute-forces weak SSH and Telnet logins, and installs itself across multiple CPU architectures. It also deletes rival malware and persistence tools to keep control of infected devices.
C0XMO is like a sneaky thief that finds a weak door in a router, sneaks in, then tries to spread to other gadgets in the house. It also kicks out other troublemakers so it can keep using the device like its own remote-controlled robot.
Analysis
What the researchers found
Fortinet says C0XMO is a new Gafgyt variant aimed at DD-WRT router firmware, but it is built to move beyond routers and infect other device types too. Samples were found for ARM, MIPS, PowerPC, SuperH, x86, x86_64, and other architectures, with code for DVRs, routers, video management platforms, and Android-based devices.
The botnet spreads by exploiting CVE-2021-27137, an unauthenticated buffer overflow in DD-WRT. After landing on a device, it downloads a Python scanner that installs packages such as requests, paramiko, and beautifulsoup4, then scans internet-facing systems on ports commonly used by SSH, Telnet, web services, and related management interfaces.
How it operates
Once it finds a target, C0XMO tries weak SSH and Telnet credentials, identifies the device architecture, and drops a matching binary. It copies itself into hidden paths like /tmp/.sys and /var/tmp/.sys, then uses cron jobs and shell startup files to relaunch itself regularly.
Fortinet also says the malware hunts for other botnet clients, red-team tools, programming utilities, and network services that could interfere with its operation. It deletes binaries and removes persistence mechanisms such as cron jobs, init scripts, system services, and shell profile entries.
Why it matters
The malware is still centered on DDoS. Fortinet says it supports 19 attack methods, including UDP, TCP, SYN, and ICMP floods, plus amplification and other flood types. It then connects to a hardcoded C2 server through a custom handshake and waits for commands such as scans, heartbeats, and attack launches.
The main defensive advice in the article is straightforward: keep devices updated, use unique admin credentials, and disable remote access when it is not needed. Fortinet describes C0XMO as more advanced than earlier IoT botnets, and says its design shows more operational sophistication than typical Gafgyt malware.
Key points
- Fortinet says C0XMO is a Gafgyt botnet variant targeting DD-WRT router firmware through CVE-2021-27137.
- The malware has versions for many CPU architectures and can spread to DVRs, routers, video platforms, and Android devices.
- It scans exposed systems, brute-forces weak SSH and Telnet logins, and installs persistence with cron jobs and shell startup files.
- C0XMO deletes rival malware and other tools that could interfere with its operation.
- Its main job is DDoS, with 19 supported attack methods.
If device owners patch DD-WRT and other exposed systems, use unique admin passwords, and turn off remote access when it is not needed, the botnet has fewer easy targets. Fortinet’s writeup also gives defenders concrete signs to hunt for, including the malware’s persistence tricks and process checks.
If exposed routers and IoT devices stay unpatched, C0XMO can keep brute-forcing weak credentials, reinstalling itself, and spreading across more device types. Its ability to remove competing malware and launch many DDoS methods makes infected systems harder to clean up and easier to reuse for attacks.
