A new Gafgyt botnet variant named C0XMO is actively targeting DD-WRT router firmware, with the capability to spread across multiple device types and processor architectures. The malware eliminates competing infections as it propagates.
Security researchers have identified C0XMO, an evolving strain of the Gafgyt botnet family, exploiting vulnerabilities in DD-WRT router firmware to establish infections. The botnet demonstrates notable technical sophistication through its multi-architecture support, allowing it to compromise devices beyond routers.
DD-WRT is a Linux-based firmware replacement popular among users seeking enhanced router functionality and control. The vulnerability being leveraged remains actively exploited, making affected systems significant targets for compromise.
A distinguishing characteristic of C0XMO is its aggressive behavior toward competing malware. Upon infection, the botnet actively terminates rival malware processes and infections—a competitive tactic designed to monopolize infected device resources. This behavior indicates operators prioritizing botnet stability and resource efficiency.
The multi-architecture capability is particularly noteworthy. Traditional botnets often target specific processor types, limiting their spread potential. C0XMO's ability to execute across various CPU architectures expands its attack surface considerably, enabling infection of diverse hardware platforms with different processing capabilities.
Gafgyt, the parent botnet family, has maintained a presence in the threat landscape for years, known for DDoS capabilities and credential-harvesting attacks. C0XMO represents a continued evolution of this family, incorporating lessons from previous variants and adapting to target commonly modified router firmware.
Users running DD-WRT should immediately verify firmware versions and apply available security patches. System administrators should monitor network traffic for signs of compromise, including unusual outbound connections or performance degradation. Router reset to factory settings may be necessary for confirmed infections.
The targeting of DD-WRT highlights a persistent vulnerability in modified firmware ecosystems. While such platforms offer legitimate benefits to advanced users, they often receive security updates less frequently than manufacturer-supported versions, creating windows of exploitation.
Organizations with network infrastructure using DD-WRT should prioritize rapid patching and consider network segmentation to limit botnet spread potential. The C0XMO variant underscores the ongoing threat from commodity botnet malware targeting network infrastructure vulnerabilities.
Two Nigerian men have been extradited to the U.S. and charged in connection with sextortion schemes that led to the deaths of two minors in Mississippi and North Carolina.
Threat actors are exploiting a vulnerability chain in Microsoft SharePoint to execute arbitrary code on unpatched servers. Defused has confirmed attackers are leveraging proof-of-concept exploits in the wild.
Hackers have claimed to steal millions of patient records from McKesson, the major U.S. healthcare distributor. The company acknowledged the breach and warned of potential service disruptions.
Artificial intelligence is becoming adept at finding and patching software vulnerabilities, potentially undermining governments' ability to deploy spyware and hacking tools. The development could spark renewed pressure for backdoors in encrypted devices.