Home

C0XMO

Gafgyt IoT botnet variant · DD-WRT exploitation · Multi-architecture · DDoS · Discovered March 2026 ·

Overview

C0XMO is a variant of the long-running Gafgyt (also called Bashlite) IoT botnet family, discovered by FortiGuard Labs in March 2026 and publicly documented in June 2026. It targets DD-WRT router firmware and moves to other device types across many CPU architectures, with samples found for ARM, MIPS, PowerPC, SuperH, x86, x86_64, and others. Like other Gafgyt strains, its purpose is to assemble a distributed denial-of-service botnet, and it supports 19 DDoS attack methods. What sets C0XMO apart is architectural: it separates its scanning and propagation logic into a standalone Python script, which makes it easier for the operator to update exploits, add or remove targeted architectures, and expand lateral movement independently of the main payload.

Initial access relies on CVE-2021-27137, a stack buffer overflow in the UPnP service of vulnerable DD-WRT firmware. The flaw is an unsafe strcpy in the SSDP M-SEARCH handling that lets an unauthenticated remote attacker overflow an internal fixed buffer via an oversized ST:uuid: value, reachable on UDP port 1900. It affects DD-WRT changesets before 45724 and has been fixable since 2021. The vulnerability was later added to CISA's Known Exploited Vulnerabilities catalog under BOD 26-04, and CERT-In issued a corresponding advisory rating it High. C0XMO's continued success with a five-year-old bug reflects how rarely DD-WRT and similar edge devices are patched in practice.

In the observed campaign the operator targeted a Japanese technology firm, though the source address traced to a device in Germany. The compromised host downloaded the malware to /tmp/.cache. After execution, C0XMO sets up persistence, terminates competing malware, connects to its command-and-control server through a custom three-step handshake, and then waits for scan or attack commands. For wider distribution it pulls a Python scanner from the same infrastructure that hosts the binaries and installs the requests, paramiko, and beautifulsoup4 packages to drive network scanning, HTTP exploitation, and SSH and Telnet activity.

Why this matters for defenders: C0XMO is not primarily an endpoint threat in the traditional workstation sense. It lives on routers, DVRs, video management platforms, and Android-based devices, the unmanaged edge of the network that rarely appears in an endpoint inventory or receives regular patching. A compromised device becomes both a DDoS source and an internal scanning node that brute-forces Telnet and SSH and runs HTTP exploits against neighbors. The competitor-killing behavior also means the presence of C0XMO can erase evidence of, and persistence for, other malware that was previously on the device.

Verify before relying on this: the botnet is modular, so its exploit set and targeted architectures change between builds. Network indicators (C2 IPs, distribution servers) rotate. The core behaviors (DD-WRT exploitation, Python scanner propagation, cron and shell-profile persistence, competitor killing, custom handshake, 19 DDoS methods) are the durable elements.

Operational attack chain · exploit-to-botnet lifecycle

  1. DD-WRT UPnP exploit

    CVE-2021-27137: crafted M-SEARCH to UDP 1900 overflows the SSDP buffer, unauthenticated RCE.

    T1190

  2. Payload download

    Architecture-specific ELF binary fetched to /tmp/.cache and executed.

    T1105

  3. Persistence setup

    Copies to /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys; cron every 15 min; shell profile edits.

    T1053.003T1546.004

  4. Competitor killing

    Scans /proc against a blacklist; kills rival botnets and deletes their binaries and persistence.

    T1562.001

  5. C2 handshake

    Magic string + shared secret → HANDSHAKE_OK → BOT/OK → final magic. Standby for commands.

    T1071

  6. Python scanner propagation

    Pulls scanner.py; Telnet/SSH brute force + HTTP exploits + ADB; deploys arch-matched payload.

    T1046T1110

  7. DDoS on command

    19 attack methods: UDP/TCP/SYN/ICMP floods, NTP/Memcached amplification, HTTP and game/voice floods.

    T1498T1499

The chain is self-sustaining. Every successfully compromised device runs the same scanner and becomes a new propagation node, and the cron job relaunches the bot every 15 minutes even if the process is killed. Because the entry vector is a known CVE on unmanaged devices, the most effective break points are patching and network exposure rather than payload detection alone.

Source: FortiGuard Labs analysis (June 2026); SSD Secure Disclosure CVE-2021-27137 advisory; MITRE ATT&CK

Stop threats before they spread

Detect malicious behavior, contain affected endpoints, and remediate attacks with Malware Protection Plus.

Free for 30 days. Unlimited endpoints. No credit card required.

Sign up

Tactics, techniques, and procedures

C0XMO concentrates in Initial Access, Persistence, Discovery, and Impact, with a modular Python scanner driving lateral movement. The mapping below reflects FortiGuard Labs analysis of the bot.x86_64 sample and the standalone scanner. Because the malware is modular, the exploit set and targeted architectures vary between builds; the mapped behaviors are the durable common core.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon1Resource Dev1Initial Access2Execution2Persistence3Priv. Esc0Defense Evasion2Credential Access1Discovery2Lateral2Collection0C22Exfiltration0Impact2
Technique detailKey techniques · C0XMO botnet & Python scanner
TacticTechniquesWhat C0XMO doesDefender telemetry
Reconnaissance
Scanning IP Blocks T1595.001
The Python scanner generates random public IPs and scans common IoT and management ports: 22 (SSH), 23 (Telnet), 80/443 (HTTP/HTTPS), 7547 (TR-069), 8080, 8443, 8888, 5555 (ADB), and others. It loads blacklist.txt and failed.txt to avoid honeypots, research ranges, known bot nodes, and previously failed targets.High-volume outbound SYN scans from an edge device to ports 22/23/80/443/7547/8080/8443/8888/5555; connections to random external IP ranges from a router or DVR.
Resource Development
Upload Malware T1608.001
The operator stages architecture-specific ELF payloads and the Python scanner on distribution infrastructure (217.160.125.125:15527 in the observed campaign) and runs a separate C2 server (85.215.131.70). The same host serves both the main binary and the scanner script.Outbound HTTP downloads from a single IP:port serving multiple architecture-named binaries (bot.arm, bot.mips, bot.x86_64) and a scanner.py; threat-intel matches on distribution IPs.
Initial Access
Exploit Public-Facing Application T1190External Remote Services T1133
Primary access is CVE-2021-27137, a stack buffer overflow in the DD-WRT UPnP/SSDP service triggered by an oversized ST:uuid: value in a crafted M-SEARCH request to UDP port 1900, giving unauthenticated remote code execution. The scanner adds many other HTTP exploits for secondary access, including D-Link HNAP (CVE-2015-2051), GLPI htmLawed RCE (CVE-2022-35914), AVTECH DVR flaws (CVE-2025-34054, CVE-2016-15047), NVMS-9000, and Zyxel SysTools RCE, plus Telnet/SSH weak-credential access.Inbound UDP to port 1900 with oversized SSDP M-SEARCH ST headers; IPS signatures for CVE-2021-27137; anomalous HTTP POSTs to DVR, router, and GLPI management endpoints; new inbound Telnet/SSH auth on edge devices.
Execution
Unix Shell T1059.004Python T1059.006
Exploitation drops shell commands that download and run the ELF payload (wget to /tmp, chmod 777, execute, delete). The propagation component is a Python 3 script executed with python3 /tmp/scanner.py and arguments controlling random scanning, target ports, runtime, and C2 server. pip3 installs requests, paramiko, and beautifulsoup4.Shell one-liners chaining wget/chmod/execute in /tmp on an embedded device; python3 running scanner.py; pip3 install of requests, paramiko, beautifulsoup4 with --break-system-packages.
Persistence
Cron T1053.003Unix Shell Config Modification T1546.004RC Scripts T1037.004
C0XMO checks /proc/self/exe, then copies itself to hidden paths (/tmp/.sys, /var/tmp/.sys, /dev/shm/.sys, and $HOME/.sys) with permissions 755. It installs a cron job to run itself every 15 minutes and appends launch commands to ~/.profile, ~/.bashrc, and ~/.bash_profile referencing the hidden files. It also re-executes itself if its process is terminated.New crontab entries with a */15 schedule pointing to a hidden dotfile; appended lines in ~/.bashrc/.profile referencing /tmp/.sys; files named .sys under /tmp, /var/tmp, /dev/shm; a process that respawns immediately after being killed.
Defense Evasion
File Deletion T1070.004Match Legitimate Name/Location T1036.005
Payloads are staged as hidden dotfiles (.cache, .sys) in transient directories, and the deployment one-liner deletes the downloaded binary after execution (rm -f .cache). The malware runs from memory-backed and temp locations that are wiped on reboot, complicating forensic recovery on devices without persistent logging.Creation then deletion of dotfiles in /tmp; execution from /dev/shm; short-lived files with names beginning with a dot in world-writable directories on edge devices.
Credential Access
Password Guessing T1110.001
The scanner performs weak-password brute-force attacks against Telnet and SSH services using a hardcoded credential list. On success it detects the target architecture and downloads the matching payload. This is the classic Gafgyt/Mirai default-credential propagation path, retained alongside the newer HTTP exploits.Repeated failed then successful Telnet/SSH logins from an internal edge device against other devices; authentication bursts using common default credential pairs; new SSH sessions from a router or DVR.
Discovery
Network Service Discovery T1046Process Discovery T1057
The scanner uses worker threads to check whether target ports are open and detect the service type before choosing a Telnet, SSH, HTTP, or ADB exploitation path. Locally, C0XMO enumerates all processes under /proc, comparing names against a blacklist of botnet malware, network service applications, programming tools, and red-team utilities to identify rivals to terminate.Threaded port probing across many hosts; reads across /proc/[pid]/ entries by a non-management process; service-detection traffic followed by targeted exploit attempts.
Lateral Movement
Exploitation of Remote Services T1210SSH T1021.004
After finding an exploitable target, the scanner deploys the architecture-matched C0XMO payload via a shell one-liner (cd /tmp; wget the arch binary to .cache; chmod 777; execute; delete). It reaches Telnet, SSH, HTTP-exploitable, and ADB-exposed devices, using detect_arch to select the correct binary so a single scanner covers heterogeneous device fleets.Edge devices initiating outbound SSH/Telnet and HTTP exploit traffic to peers; wget of architecture-named binaries to /tmp/.cache on newly infected hosts; ADB connections to port 5555.
Command and Control
Application Layer Protocol T1071Non-Standard Port T1571
C0XMO connects to its C2 (85.215.131.70) and completes a custom three-step handshake: it sends a magic string (669787761736865726500) with a shared secret, receives HANDSHAKE_OK, sends BOT and receives OK, then sends a final magic sequence (FF FF FF FF 75) and receives a welcome message. It then enters standby and answers ping with PONG as a heartbeat, awaiting scan or attack commands.Long-lived TCP sessions from an edge device to an unfamiliar external IP; a fixed magic-string handshake pattern; periodic small heartbeat exchanges (ping/PONG); C2 traffic on non-standard ports.
Impact
Network DoS T1498Endpoint DoS T1499
On command, C0XMO launches DDoS attacks using 19 methods: UDP, TCP, hybrid TCP+UDP, and SYN floods; Valve Source Engine, Discord voice UDP, and FiveM game floods; OVH bypass TCP/UDP floods; hex-pattern floods; NTP and Memcached amplification; ICMP floods; Ping of Death; and several HTTP flood variants including request storm, slow/IO exhaustion, spoofed, GET, and Cloudflare-bypass floods. It also runs a competitor-killing routine (T1562.001) that terminates rival malware and removes their persistence.High-volume outbound flood traffic (UDP/TCP/SYN/ICMP) from edge devices; NTP/Memcached reflection sourced from the network; sudden bandwidth saturation; process termination of other known malware on the device.
Stage 1T1190 · T1133 · T1105

How the attack starts

C0XMO's entry point is CVE-2021-27137, a stack buffer overflow in the UPnP service of DD-WRT router firmware. The vulnerability is an unsafe strcpy in the SSDP M-SEARCH handling: when the SSDP parser mishandles an oversized ST:uuid: value in a crafted M-SEARCH request sent to UDP port 1900, an unauthenticated remote attacker can overflow an internal fixed buffer and execute arbitrary code. The flaw affects DD-WRT changesets before 45724 and was disclosed in 2021, with a fix available at changeset 45724. It has since been added to CISA's Known Exploited Vulnerabilities catalog and covered by a CERT-In advisory rated High.

In the campaign FortiGuard Labs analyzed, the operator targeted a Japanese technology firm while the source address traced to a device in Germany, a common pattern where earlier-compromised devices are used to attack new ones. On success, the exploit drops shell commands that download an architecture-specific ELF payload to /tmp/.cache, set it executable, run it, and then delete the downloaded file. FortiGuard found samples compiled for ARM, MC68000, MIPS R3000, PowerPC, SuperH, Intel 80386, and AMD64, so the same operation can infect a wide range of embedded Linux devices.

For defenders, the important framing is that no novel exploit is involved. This is a five-year-old, patchable CVE on a class of device that is rarely inventoried or patched. The most effective control is not payload detection but reducing exposure: patching DD-WRT to changeset 45724 or later, disabling UPnP where it is not required, and ensuring UDP 1900 is not reachable from untrusted networks.

Stage 2T1053.003 · T1546.004 · T1562.001

What runs on the device

Once executed, C0XMO sets up persistence in four stages. It first checks its own path through /proc/self/exe, then generates hidden file paths and copies itself to /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys, and, if a home directory exists, $HOME/.sys, setting permissions to 755. It installs a cron job that relaunches the malware every 15 minutes, so killing the process alone does not remove it. It appends launch commands to ~/.profile, ~/.bashrc, and ~/.bash_profile that reference the hidden files, and it re-executes itself if terminated. The redundancy across cron, shell profiles, and multiple hidden copies is designed to survive partial cleanup on devices that lack proper endpoint management.

C0XMO then performs competitor killing. It verifies its own PID and executable name to avoid deleting itself, then scans every process under /proc and compares names against an internal blacklist covering rival botnet malware, network service applications, programming tools, and red-team utilities. Matching processes are terminated. It then compares the executable paths of killed processes against a path blacklist and deletes matching binaries, and it goes further by removing rival persistence such as cron jobs, rc.local entries, init.d services, systemd services, and shell profile scripts. The effect is that C0XMO both claims the device's resources for itself and can destroy evidence of prior infections.

Stage 3T1071 · T1571 · T1498

Command and control, and DDoS

After persistence, C0XMO connects to its C2 server and completes a custom three-step handshake. It first sends a magic string (669787761736865726500) together with a shared secret and waits for the server to reply HANDSHAKE_OK. It then sends BOT to identify itself as a botnet node and receives OK. Finally it sends the hexadecimal sequence FF FF FF FF 75 as a final magic value and receives a welcome message confirming the handshake completed. The bot then enters standby and responds to a ping command with PONG as a heartbeat, confirming it is still alive and reachable.

The command handler supports a small set of control verbs (ping, stop, scan, stopscan) plus attack commands. The DDoS capability is broad: 19 methods spanning volumetric floods (UDP, TCP, hybrid TCP+UDP, SYN, ICMP), amplification (NTP, Memcached), application and game-service floods (Valve Source Engine, Discord voice UDP, FiveM, OVH bypass TCP/UDP), a Ping of Death, and several HTTP flood variants including request storm, slow/IO exhaustion, spoofed, GET, and Cloudflare-bypass. This range lets a single botnet target gaming infrastructure, voice platforms, and web services with method selection tuned to the victim.

For network defenders, the durable detection opportunities here are the fixed handshake pattern and the outbound flood behavior. The handshake uses constant magic values that do not change with infrastructure rotation, and the flood traffic (especially NTP and Memcached reflection or large UDP/SYN volumes sourced from edge devices) is visible at the network layer even when the payload itself is not.

Stage 4T1046 · T1110.001 · T1210 · T1608.001

How it spreads: the Python scanner

C0XMO's defining evolution over older Gafgyt strains is that lateral movement is a standalone Python script rather than logic baked into the ELF binary. The bot fetches scanner.py from the same infrastructure that distributes the payloads (217.160.125.125:15527 in the observed campaign) and installs requests, paramiko, and beautifulsoup4 with pip3. It then runs the scanner with arguments enabling random IP scanning, a target port list (23, 22, 80, 443, 8080, 5555, 5511, 5554, 4443, 81, 8000, 7547, 8081, 8443, 8888), a runtime duration, and the C2 server address. Separating the scanner this way lets the operator update exploits and targets without rebuilding or redistributing the main binary.

The scanner has roughly 22 functions across six groups: Worker, Blacklist, Telnet, SSH, HTTP Exploit, and ADB Exploit. It first loads blacklist.txt and failed.txt to avoid honeypots, research institutions, known bot nodes, and previously failed targets. Worker threads then retrieve a target, check the blacklist, probe whether ports are open, detect the service type, and attempt Telnet, SSH, HTTP, and ADB exploitation. On a successful Telnet or SSH weak-credential login, the scanner runs detect_arch to identify the target's CPU architecture and downloads the matching payload with a shell one-liner (cd /tmp; wget the arch binary to .cache; chmod 777; execute; remove).

The HTTP exploit set is extensive and targets known device vulnerabilities beyond DD-WRT: D-Link HNAP SOAP injection (CVE-2015-2051), GLPI htmLawed RCE (CVE-2022-35914) and GLPI barcode injection, AVTECH DVR flaws (CVE-2025-34054, CVE-2016-15047), NVMS-9000, broadband router flaws, and Zyxel SysTools RCE. A dedicated ADB module targets Android devices with exposed debug interfaces on port 5555, a category of hardware most enterprise security teams do not monitor. This breadth is why a single compromised router can seed infection across a heterogeneous fleet of routers, DVRs, video platforms, and Android devices.

Execution flow

What C0XMO looks like on an infected device

Where Malware Protection Plus fits

C0XMO lives on embedded Linux edge devices (routers, DVRs, Android) that a Windows endpoint agent does not run on directly. Its relevance to a managed environment is twofold: infected edge devices attack and scan the managed estate, and the same worming behavior can reach any exposed Linux host. Malware Protection Plus focuses on the managed Windows and Linux endpoints that sit inside the blast radius of a C0XMO infection.

On a managed Linux host, the observable behaviors are concrete: a shell chaining wget, chmod 777, and execution of a dotfile in /tmp; dotfiles named .sys under /tmp, /var/tmp, and /dev/shm; new cron entries with a */15 schedule pointing to a hidden file; appended launch lines in shell profiles; and a python3 process brute-forcing SSH and Telnet against other hosts. Malware Protection Plus can help detect these behaviors, isolate an affected host to stop it scanning and flooding, and preserve the persistence artifacts for investigation.

For the unmanaged edge devices themselves, the primary controls are network and configuration level: patching DD-WRT, disabling UPnP and unnecessary Telnet/SSH, and restricting UDP 1900 and management ports. Endpoint telemetry complements this by catching the lateral movement and DDoS behavior once it reaches a host that is managed, and by giving responders a view of which internal systems an infected device is targeting.

Indicators of compromise

Durable behavioral and artifact indicators outlast the volatile network indicators, which rotate as the operator changes infrastructure and rebuilds payloads. The C2 and distribution IPs and the file hashes below are specific to the campaign FortiGuard documented and should be treated as time-limited.

Durable — host artifacts and behavior

6 indicators

Filesystem, persistence, and behavioral patterns that recur across C0XMO builds.

  • Dotfiles named .sys in /tmp, /var/tmp, /dev/shm, and $HOMEC0XMO self-copy locations (permissions 755)
  • Cron entry: */15 * * * * pointing to a hidden dotfileRelaunches the bot every 15 minutes
  • Appended launch lines in ~/.bashrc, ~/.profile, ~/.bash_profile referencing /tmp/.sysShell-profile persistence
  • wget/chmod 777/execute/rm chain writing to /tmp/.cachePayload deployment one-liner; downloaded binary deleted after run
  • python3 /tmp/scanner.py --rand --rand-ports 23,22,80,443,8080,5555,...Standalone scanner execution; pip3 installs requests, paramiko, beautifulsoup4
  • C2 handshake: magic 669787761736865726500 → HANDSHAKE_OK → BOT/OK → FF FF FF FF 75Fixed handshake magic values; PONG heartbeat response to ping

Durable — exploited CVEs

Access + propagation

Vulnerabilities C0XMO uses for initial access and lateral movement. Patch state is the strongest control.

  • CVE-2021-27137 — DD-WRT UPnP/SSDP buffer overflow (UDP 1900)Primary initial access; fixed in DD-WRT changeset 45724; on CISA KEV
  • CVE-2015-2051 (D-Link HNAP) · CVE-2022-35914 (GLPI htmLawed)Scanner HTTP exploits for secondary access
  • CVE-2025-34054 · CVE-2016-15047 (AVTECH DVR) · NVMS-9000 · Zyxel SysTools RCEAdditional device exploits in the scanner set
  • Android Debug Bridge (ADB) unauthorized access, port 5555Reaches exposed Android devices

Volatile — network infrastructure

Volatile · rotates

C2 and distribution hosts from the documented campaign. Expect rotation.

  • 217.160.125[.]125:15527Binary and scanner.py distribution host
  • 85.215.131[.]70C2 server
  • 176.100.37[.]91Related host from documented IOCs

Volatile — file hashes (SHA-256)

Volatile · per-build

Multi-architecture ELF samples from the documented campaign. Use as confirmatory signals.

  • 444a9d34a9f59dc7975dfabefb47d789813a4497bbac9127c4806dd816e85211C0XMO ELF sample
  • 9394666007fac4014a4641fdae150c1b969ed2bc4299876318a336fd386abf59C0XMO ELF sample
  • 450ea44da0c9d96a2e8f4d6bad34f1c35cd35743295b8cd2defa9f7a9884685dC0XMO ELF sample
  • d452f22dacab9785539484245c13e9cce58df23fc82eeef205684fcd196da20bC0XMO ELF sample
  • 20042f1efb59c99e3addf822a3e9e5a496f0b701362df038a50a32a9f504a136C0XMO ELF sample
  • 7413cbb6eab4d6b10346f71be5dd76d7cf2f4817f7776367b162f83755aefa1fC0XMO ELF sample (full set of 15 hashes in FortiGuard IOCs)

Detection guidance

Because C0XMO runs on embedded devices and rebuilds per architecture, hash and signature detection is fragile. The reliable detections are behavioral and network based: the exploit traffic on the way in, the persistence and scanner behavior on the device, and the handshake and flood traffic on the way out. Detections are ordered roughly by kill-chain position.

  1. 01

    Malformed SSDP M-SEARCH to UDP 1900

    Network / IPS telemetry

    What to monitor: inbound UDP traffic to port 1900 containing oversized ST:uuid: values in SSDP M-SEARCH requests, matching CVE-2021-27137 exploitation. Deploy or enable an IPS signature for this CVE at network boundaries in front of DD-WRT and other UPnP-capable devices.

    Why it works: the exploit has a distinct malformed-packet signature and targets a specific service. Catching it at the network edge stops initial access before the payload runs, and works even though the device itself has no endpoint agent.

  2. 02

    Shell download-execute-delete chains in /tmp on edge devices

    Process / EDR (Linux) telemetry

    What to monitor: shell commands chaining wget or curl of an externally hosted binary into /tmp/.cache, followed by chmod 777, execution, and rm. On managed Linux hosts, alert on any process writing an executable dotfile to /tmp, /var/tmp, or /dev/shm and running it.

    Why it works: this deployment one-liner is common to C0XMO across architectures. The download-to-hidden-path-then-delete pattern is rare in legitimate operations and is a high-confidence infection signal on any Linux host that is managed.

  3. 03

    Cron and shell-profile persistence to hidden dotfiles

    File integrity / EDR telemetry

    What to monitor: new crontab entries with a */15 schedule that point to a hidden dotfile in a temp directory, and appended launch lines in ~/.bashrc, ~/.profile, or ~/.bash_profile referencing paths like /tmp/.sys. Alert on creation of .sys files under /tmp, /var/tmp, and /dev/shm.

    Why it works: the 15-minute cron cadence to a hidden file and the specific shell-profile edits are consistent across builds. These are durable host artifacts that survive the deletion of the initial download.

  4. 04

    Python scanner behavior: pip3 of requests/paramiko/beautifulsoup4 then threaded scanning

    Process / network telemetry

    What to monitor: pip3 installing requests, paramiko, and beautifulsoup4 (often with --break-system-packages) on a device that has no development role, followed by a python3 process opening many outbound connections to ports 22, 23, 80, 443, 7547, 8080, 8443, 8888, and 5555 across random external IPs.

    Why it works: this package trio plus threaded multi-port scanning from an edge device or server is specific to the C0XMO scanner. Legitimate systems rarely install paramiko and beautifulsoup4 together and then immediately brute-force SSH and Telnet against random hosts.

  5. 05

    Outbound Telnet/SSH brute force and ADB from internal devices

    Network telemetry

    What to monitor: internal routers, DVRs, or servers initiating repeated Telnet (23) and SSH (22) authentication attempts against many peers, and connections to ADB port 5555. Correlate failed-then-successful auth patterns with subsequent wget of architecture-named binaries.

    Why it works: a device that normally receives connections suddenly initiating credential brute force and ADB access to peers is a strong lateral-movement indicator. It catches propagation regardless of which CVE or credential set the scanner used.

  6. 06

    C0XMO C2 handshake pattern

    Network telemetry

    What to monitor: outbound TCP sessions from an edge device that begin with the fixed magic string 669787761736865726500, elicit HANDSHAKE_OK, then exchange BOT/OK and a final FF FF FF FF 75 sequence, followed by periodic ping/PONG heartbeats.

    Why it works: these magic values are constant and do not change when the operator rotates C2 IPs. A network signature on the handshake byte pattern detects C0XMO check-ins even against previously unseen C2 infrastructure.

  7. 07

    Outbound DDoS and amplification traffic from edge devices

    NetFlow / network telemetry

    What to monitor: sudden high-volume outbound UDP, TCP, SYN, or ICMP traffic from routers, DVRs, or IoT devices, and NTP or Memcached reflection patterns sourced from your network. Watch for sustained bandwidth saturation toward a single external target.

    Why it works: DDoS is C0XMO's purpose, and the flood traffic is visible at the network layer even when the device payload is invisible. Amplification traffic (NTP, Memcached) originating from your address space is both a detection signal and a reputational risk to address quickly.

  8. 08

    Competitor-killing process and file activity

    Process / EDR (Linux) telemetry

    What to monitor: a process enumerating /proc and terminating multiple other processes by name, followed by deletion of binaries and removal of cron jobs, rc.local entries, init.d/systemd services, and shell-profile lines belonging to other malware.

    Why it works: mass process termination combined with persistence removal across multiple mechanisms is unusual and specific to competitor-killing IoT botnets. On managed Linux hosts this behavior stands out clearly against normal activity.

Hardening and response recommendations

C0XMO depends on unpatched DD-WRT firmware, exposed UPnP and management services, weak Telnet/SSH credentials, and unmonitored edge devices. The controls below target those dependencies. Quick win = single configuration change, deployable in days. Standard = needs a rollout or inventory effort, deployable in weeks.

  1. Patch DD-WRT and exploited devices

    Critical

    CVE-2021-27137 was fixed in DD-WRT changeset 45724. The vulnerability is on CISA's Known Exploited Vulnerabilities catalog and carries a CERT-In High advisory. Update DD-WRT firmware to changeset 45724 or later, and patch the other devices the scanner targets (D-Link, GLPI, AVTECH DVRs, NVMS-9000, Zyxel) to close secondary propagation paths.

    Do: inventory all DD-WRT and Buffalo devices running DD-WRT, prioritize internet-facing units, and apply the vendor firmware fix. Where a device is end-of-life and cannot be patched, isolate or replace it.

  2. Disable UPnP and restrict UDP 1900

    Quick win

    The exploit requires UPnP to be enabled and reachable. UPnP is off by default on DD-WRT and only listens on internal interfaces by default, so exposure usually comes from a configuration change. Disable UPnP where it is not required and ensure UDP port 1900 is not reachable from untrusted networks.

    Do: turn off UPnP on routers that do not need it, block inbound UDP 1900 at the perimeter, and confirm SSDP is not exposed on WAN interfaces. This removes the initial-access surface for CVE-2021-27137 outright.

  3. Disable Telnet, restrict SSH, and enforce strong credentials

    Standard

    The scanner brute-forces Telnet and SSH with hardcoded weak credentials. Disabling Telnet entirely, restricting SSH to management networks, and replacing default and weak passwords with strong unique credentials removes the classic Gafgyt propagation path.

    Do: disable Telnet on all IoT and network devices, limit SSH exposure with ACLs, enforce unique non-default admin credentials, and use key-based SSH auth where the device supports it.

  4. Close exposed ADB and management interfaces

    Quick win

    The scanner reaches Android devices through exposed Android Debug Bridge on port 5555, a surface most teams do not monitor. It also targets TR-069 (7547) and various web management ports. Restricting these ports at the network edge removes several propagation routes.

    Do: block inbound access to ADB (5555), TR-069 (7547), and device web management ports (8080, 8443, 8888) from untrusted networks. Disable ADB over network on Android-based devices that do not require it.

  5. Segment and monitor IoT and edge devices

    Standard

    Compromised edge devices become internal scanning and DDoS nodes. Placing IoT and network devices on segmented VLANs with controlled egress limits how far a single infection can spread and makes the scanner's outbound brute-force and flood traffic easier to spot.

    Do: segment IoT and management devices away from user and server networks, apply least-privilege egress rules, and monitor for outbound scanning, brute force, and flood traffic sourced from these segments. Alert on edge devices initiating connections they should only receive.

  6. Respond: isolate, clean persistence, rebuild if needed

    Quick win

    On a suspected C0XMO infection, isolate the device from the network to stop its scanning and DDoS activity. Because persistence is redundant (cron, shell profiles, multiple hidden copies, self-respawn), removing a single artifact is not enough. Remove the cron entry, clean the shell-profile edits, and delete all .sys copies, then verify the process does not respawn.

    Do: for embedded devices without proper management, a factory reset followed by firmware update and credential change is often the most reliable remediation. On managed Linux hosts, remove all persistence mechanisms, rotate credentials that were exposed, and hunt for the scanner and handshake indicators across the rest of the fleet.

Primary references

Source material this page is built on. Technical claims trace to the original FortiGuard Labs research, with the CVE detail confirmed against the disclosure advisory and government sources. MITRE ATT&CK provided the technique framework. Reviewed through August 2026.

Catch the endpoint-side blast radius of an IoT botnet.

Malware Protection Plus helps security teams detect C0XMO's lateral movement, persistence, and DDoS behavior on managed Linux and Windows hosts, isolate affected systems, and investigate what an infected edge device is targeting.

Start free trial →