Modular C0XMO Botnet Hijacks DD-WRT Routers and Eliminates Rival Malware

Fortinet researchers discovered C0XMO, an advanced Gafgyt botnet variant that exploits CVE-2021-27137 in DD-WRT firmware to infect routers and IoT devices across multiple CPU architectures. The malware uses Python-based scanners to brute-force SSH/Telnet credentials, laterally move through networks, and terminate competing botnets and red-team tools. It establishes persistence via cron jobs and hidden files, then awaits commands to launch one of 19 DDoS attack methods from its hardcoded C2 server. Defenders should patch routers, disable unnecessary remote access, and use strong, unique admin credentials.