Our researchers identified threat actors exploiting misconfigured Docker servers to spread the Gafgyt malware. This threat traditionally targets IoT devices; this new tactic signals a change in its…

A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures.

Overview In June 2025, NSFOCUS Fuying Lab Global Threat Hunting System detected that a new botnet family developed based on Go language was spreading on a large scale, and continued to iterate version...

Our researchers identified threat actors exploiting misconfigured Docker servers to spread the Gafgyt malware. This threat traditionally targets IoT devices; this new tactic signals a change in its…

Our researchers identified threat actors exploiting misconfigured Docker servers to spread the Gafgyt malware. This threat traditionally targets IoT devices; this new tactic signals a change in its be...

Introduction The threat landscape surrounding Internet-connected devices continues to evolve as attackers refine old malware families with new capabilities. Security researchers have recently highlighted the emergence of C0XMO, a modular botnet derived from the notorious Gafgyt malware family. The campaign focuses heavily on compromised DD-WRT routers, exploiting known vulnerabilities and weak authentication mechanisms to silently recruit devices into a large-scale malicious network.

Moobot, Miori, AGoent, and a Gafgyt variant have joined the infamous Mirai botnet in attacking unpatched versions of vulnerable Wi-Fi routers.

C0XMO is a new Gafgyt botnet variant exploiting old router flaws, spreading across IoT devices, killing rivals, and enabling large-scale DDoS attacks. In March 2026, FortiGuard Labs discovered a new variant of the Gafgyt botnet, dubbed C0XMO, which is noticeably more capable than its predecessors. The malware spreads through CVE-2021-27137, a stack buffer overflow in […]

Introduction: A Familiar Threat Returns in a More Dangerous Form The Linux threat landscape has entered another turbulent chapter with the emergence of C0XMO, a newly discovered variant of the infamous Gafgyt botnet. While Gafgyt has been a persistent menace for years, this latest evolution demonstrates how cybercriminals continue to refine and modernize old malware families to maximize their reach and destructive capabilities.

A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures. [...]

C0XMO is a new Gafgyt botnet variant exploiting old router flaws, spreading across IoT devices, killing rivals, and enabling large-scale DDoSs

Cybersecurity researchers are calling attention to a spike in automated attacks targeting PHP servers, IoT devices, and cloud gateways by various botnets such as Mirai, Gafgyt, and Mozi. "These automated campaigns exploit known CVE vulnerabilities and cloud misconfigurations to gain control over exposed systems and expand botnet networks," the Qualys Threat Research Unit (TRU) said in a report

A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures.

A new variant of the Gafgyt botnet called C0XMO is targeting DD-WRT router firmware and can move to other device types with various CPU architectures.

Cybersecurity researchers are calling attention to a spike in automated attacks targeting PHP servers, IoT devices, and cloud gateways by various botnets such as Mirai, Gafgyt, and Mozi. "These automated campaigns exploit known CVE vulnerabilities and cloud misconfigurations to gain control over exposed systems and expand botnet networks," the Qualys Threat Research Unit (TRU) said in a report

Cybersecurity researchers are calling attention to a spike in automated attacks targeting PHP servers, IoT devices, and cloud gateways by various botnets such as Mirai, Gafgyt, and Mozi. "These automated campaigns exploit known CVE vulnerabilities and cloud misconfigurations to gain control over exposed systems and expand botnet networks," the Qualys Threat Research Unit (TRU) said in a report

Cybersecurity researchers have reported a significant rise in automated attacks targeting PHP servers, IoT devices, and cloud gateways by botnets such as Mirai, Gafgyt, and Mozi. According to the Qualys Threat Research Unit (TRU), these campaigns exploit known CVEs and cloud misconfigurations to take control of exposed systems and expand botnet networks. The technical implications of these attacks are substantial. Automated attacks allow for rapid exploitation of vulnerabilities at scale, leading to widespread compromises. The use of known CVEs highlights the importance of timely patching and proper configuration management. The impact on the cybersecurity landscape includes potential data breaches, service disruptions, and the propagation of botnets, which can be used for various malicious activities, including DDoS attacks. For cybersecurity professionals, this underscores the need for robust patch management processes and regular vulnerability assessments. Organizations should prioritize patching known vulnerabilities and reviewing cloud configurations to mitigate risks. Additionally, continuous monitoring for signs of compromise and having a well-defined incident response plan are crucial. Expert insights suggest that the persistence and evolution of botnets like Mirai, Gafgyt, and Mozi pose ongoing threats. These botnets are known for their ability to spread quickly and cause significant damage. Therefore, proactive measures and a strong security posture are essential to defend against these automated attacks.

Global Security Flashpoint Introduction The cybersecurity landscape has once again been shaken by a dual revelation that highlights how fragile modern digital infrastructure has become. On one side, FortiGuard Labs has uncovered a newly evolving botnet strain known as C0XMO, derived from the infamous Gafgyt family, actively exploiting a known vulnerability in DD-WRT routers. On the other side, a separate but equally alarming issue surfaced in a GitHub Actions workflow tied to Anthropic’s Claude Code, revealing how a single malicious input could potentially compromise public repositories in a supply chain-style attack.

At a Glance Malware family Gafgyt / BASHLITE variant (DDoS bot) Threat actor Unattributed; banner references handle "rimasuta" Targets Internet-exposed Langflow AI servers (x86_64 Linux) Delivery vector RCE via Langflow code validation API (CVE-2025-3248) Key capabilities UDP, TCP, HOLD, and junk/STD network floods Source Akamai Security Research TL;DR Akamai found a new Gafgyt botnet campaign that hijacks AI infrastructure. Attackers exploit a Langflow remote code execution flaw to drop a stripped-down DDoS payload.