Gafgyt Malware Variant Expands Attacks Across Linux Architectures

A new variant of the Gafgyt botnet, tracked as C0XMO, is rapidly expanding its reach across multiple Linux architectures. Discovered earlier this year, this malware initially breaches systems by exploiting CVE-2021-27137, a stack buffer overflow vulnerability found in the UPnP service of specific DD-WRT routers. By sending specially crafted M-SEARCH requests over UDP port 1900, attackers can force a buffer overflow and download the primary payload directly into the…

Diamond Model