C0XMO botnet hijacks DDâWRT routers, outpaces Gafgyt in the wild
**A New Threat Looms: C0XMO Takes Control of Consumer Routers** The C0XMO botnet, an emerging branch of the longâstanding Gafgyt malware family, is exploiting a decadesâold vulnerability in DDâWRT firmware to seize control of home gateways. By compromising the routerâs web interface and deploying a lightweight loader, the malware can download additional payloads and propagate across devices with diverse CPU architectures, markedly increasing its reach in the wild. ### Key Takeaways - **Legacy flaw revived:** C0XMO leverages a wellâknown DDâWRT webâinterface vulnerability that remains unpatched on many consumer routers. - **Modular infection chain:** After initial access, the botnet injects a minimalist loader that fetches further malicious modules, enabling rapid capability expansion. - **Crossâarchitecture spread:** The malware is engineered to operate on multiple CPU types, allowing it to infect a broad spectrum of home and IoT devices. - **Gafgyt lineage:** While derived from Gafgyt, C0XMO exhibits more sophisticated persistence and commandâandâcontrol mechanisms. - **Immediate risk:** Unpatched DDâWRT routers become entry points for DDoS attacks, credential harvesting, and lateral movement within home networks. - **Mitigation priority:** Users should update firmware, replace unsupported devices, and enforce strong administrative passwords. - **Research implications:** The discovery underscores the need for continuous monitoring of legacy firmware ecosystems. #C0XMO #DDWRT #Botnet #Gafgyt #RouterSecurity #IoTSecurity #FirmwareVulnerability #CyberThreat #Malware #newsababil360 [Read Full Article](https://news.ababil360.com/c0xmo-botnet-hijacks-dd-wrt-routers-outpaces-gafgyt-in-the-wild/)
