C0XMO botnet hijacks DD‑WRT routers, outpaces Gafgyt in the wild

C0XMO botnet exploits DD-WRT flaw

The C0XMO botnet, a fresh offshoot of the notorious Gafgyt family, is weaponising a long‑standing vulnerability in DD‑WRT router firmware to commandeer home gateways and expand across heterogeneous CPU architectures.

Researchers observed that the malware first compromises the router’s web interface, then injects a lightweight loader capable of downloading additional payloads for ARM, MIPS and x86 devices. Within weeks, infection counts surged, prompting a ↓ 45% dip in the rival Gafgyt’s active bots as C0XMO outcompetes it for resources.

“The speed at which C0XMO propagates suggests a sophisticated supply chain, possibly leveraging compromised firmware updates,” said a senior analyst at Reuters.

Security firms warn that the botnet’s modular design enables it to drop ransomware, cryptominers or espionage tools, turning ordinary routers into footholds for broader campaigns. Mitigation requires immediate firmware patches and disabling remote management ports.

For detailed remediation steps, see the advisory from Bloomberg Security.