TLDR Tech / InfoSec
C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
Fortinet has identified C0XMO, a modular Gafgyt variant, that exploits CVE-2021-27137, an unauthenticated buffer overflow in DD-WRT router firmware. This vulnerability allows for arbitrary code execution, enabling the botnet to spread across various devices including DVRs, routers, video management platforms, and Android devices, by shipping binaries for multiple architectures. C0XMO supports 19 DDoS methods and uses a Python scanner to brute-force weak SSH and Telnet credentials. It achieves persistence by hiding copies in /tmp/.sys, /var/tmp/.sys, and /dev/shm/.sys, and through cron jobs that relaunch every 15 minutes. The botnet also terminates competing botnets and interfering services. To defend against C0XMO, users should keep devices patched, use unique admin credentials, disable unneeded remote access, and monitor for the specified hidden paths, cron persistence, and unexpected scanning activity.
Read the full story