C0XMO botnet spreads via DD-WRT router flaw, kills rival malware

Fortinet researchers discovered C0XMO, a Gafgyt botnet variant targeting DD-WRT routers via CVE-2021-27137, a buffer overflow vulnerability allowing unauthenticated remote code execution. The malware supports 19 DDoS methods, scans for devices across multiple CPU architectures, and actively removes competing malware from infected systems. Its modular design lets operators update exploits and expand lateral movement independently.