FortiGuard Labs identified a new Gafgyt botnet strain named C0XMO that propagates by exploiting a buffer overflow flaw in DD-WRT routers tracked as CVE-2021-27137 . The malware uses a separate Python-based scanner to broaden infections across different CPU architectures, while also relying on weak-credential attacks, several DDoS capabilities, and routines to remove competing malware. After infection, it establishes persistence through hidden files, cron jobs, and shell profile changes before reaching out to its command-and-control server. The report also includes indicators and defensive guidance for organizations operating exposed IoT devices.
The analysis shows that C0XMO abuses CVE-2021-27137 in the DD-WRT UPnP service to obtain initial access, then retrieves a Python scanner from 217.160.125.125:15527 . That scanner carries out Telnet and SSH brute-force attempts, launches multiple HTTP-based exploit requests, and deploys architecture-specific binaries depending on the target environment. Persistence is maintained through hidden files placed in locations such as /tmp , /var/tmp , /dev/shm , and user directories, along with cron-job entries and shell profile edits. The malware then communicates with its C2 infrastructure at 85.215.131.70 using a custom handshake sequence.
Organizations should upgrade DD-WRT firmware to a release newer than changeset 45723 and apply fixes for all related CVEs. Unnecessary remote services such as UPnP, Telnet, and SSH should be disabled on internet-facing devices whenever possible. Strong, unique credentials should be enforced across all edge devices, and exposed services should be reviewed regularly. Network-based detections should also be deployed for the identified IP addresses, ports, and malicious command patterns associated with the campaign.
Defenders should monitor outbound traffic for connections to the known C2 infrastructure and the scanner download port. Alerts should be configured for hidden files named .sys , cron changes that execute every 15 minutes, and execution of the scanner script. The identified malicious IPs and domains should be blocked at the firewall, and any compromised devices should be isolated for forensic review and full cleanup.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: The adversary’s bot, already installed on the compromised host via service execution (T1546.007), initiates a C2 handshake with the hard‑coded server 217.160.125.125 on port 15527. The connection uses a plain TCP socket to pull commands, matching the rule’s criteria exactly. This activity is typical of the C0XMO botnet’s “phone‑ ” behavior.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
