C0XMO botnet hijacks DD‑WRT routers, outpaces Gafgyt in the wild

#c0xmo #ddwrt #botnet #gafgyt

A New Threat Looms: C0XMO Takes Control of Consumer Routers

The C0XMO botnet, an emerging branch of the long‑standing Gafgyt malware family, is exploiting a decades‑old vulnerability in DD‑WRT firmware to seize control of home gateways. By compromising the router’s web interface and deploying a lightweight loader, the malware can download additional payloads and propagate across devices with diverse CPU architectures, markedly increasing its reach in the wild.

Key Takeaways

Legacy flaw revived: C0XMO leverages a well‑known DD‑WRT web‑interface vulnerability that remains unpatched on many consumer routers.
Modular infection chain: After initial access, the botnet injects a minimalist loader that fetches further malicious modules, enabling rapid capability expansion.
Cross‑architecture spread: The malware is engineered to operate on multiple CPU types, allowing it to infect a broad spectrum of home and IoT devices.
Gafgyt lineage: While derived from Gafgyt, C0XMO exhibits more sophisticated persistence and command‑and‑control mechanisms.
Immediate risk: Unpatched DD‑WRT routers become entry points for DDoS attacks, credential harvesting, and lateral movement within home networks.
Mitigation priority: Users should update firmware, replace unsupported devices, and enforce strong administrative passwords.
Research implications: The discovery underscores the need for continuous monitoring of legacy firmware ecosystems.