C0XMO Gafgyt Botnet Leverages DD‑WRT Flaw to Infect IoT Devices and Eliminate Rivals
FortiGuard Labs uncovered C0XMO, a Gafgyt‑derived botnet that exploits the unauthenticated UPnP buffer overflow (CVE‑2021‑27137) in outdated DD‑WRT router firmware to spread across IoT devices. It copies itself to hidden locations, creates cron jobs for persistence, and kills competing botnets and red‑team tools, extending its reach to multiple Linux architectures.