Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO

C0XMO | FortiGuard Labs

By Vincent Li

Affected Platforms: DD-WRT changeset before 45723

Impacted Users: Any organization

Impact: Remote attackers gain control of the vulnerable systems

Severity Level: High

This past March, FortiGuard Labs discovered a new Gafgyt botnet variant, C0XMO, that spreads by exploiting CVE-2021-27137. Our analysis revealed that, unlike earlier versions, this malware separates its lateral movement into a standalone Python script. This approach helps the attacker target various system architectures and device types more efficiently. Below is a detailed technical overview of its structure, propagation methods, and attack features.

The t…