New Gafgyt Variant Targets Multiple Linux Architectures With Modular Propagation

Cybersecuritynews •Tushar Subhra Dutta • June 5, 2026

A newly discovered variant of the Gafgyt botnet malware, named C0XMO, has been quietly spreading across Linux-based devices by targeting a known vulnerability in DD-WRT router firmware. The malware exploits a stack buffer overflow flaw in the UPnP service of affected routers, letting attackers gain full access without any credentials. Once inside, it works to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

C0XMO Gafgyt Variant Exploits DD-WRT Routers via CVE-2021-27137 A new Gafgyt botnet variant named C0XMO has emerged, targeting DD-WRT routers by exploiting CVE-2021-27137, a buffer overflow vulnerability in the UPnP service. This malware employs a Python-based scanner to propagate across various CPU architectures, utilizing weak credentials and DDoS capabilities. Once infected, it establishes persistence through hidden files, cron jobs, and shell profile modifications. The botnet communicates with its command-and-control server at 85.215.131.70. Organizations are advised to upgrade their DD-WRT firmware and disable unnecessary remote services. Indicators of compromise (IOCs) and defensive measures are provided for affected systems. The malware's ability to spread across different Linux devices highlights a significant shift in IoT malware tactics. 6 sources 73

Extracted Entities

New Gafgyt Variant Targets Multiple Linux Architectures With Modular Propagation

The full story

Extracted Entities

Attack Types (2)

CWE Weaknesses (1)

Malware (1)

Platforms (2)