COXMO Botnet Variant: New Advanced Threat Exploits Router Firmware

Security researchers identified an active COXMO botnet variant targeting internet-connected infrastructure by exploiting known router firmware vulnerabilities (CVE-2021-27137). The malware deploys architecture-specific payloads, establishes persistence via hidden files and frequent cron jobs, removes competing botnets, and connects to command servers using cryptographic handshakes to receive instructions for large-scale DDoS (19 flood methods). Lateral propagation is handled by a separate Python scanning module that exploits routers, databases, and exposed ADB interfaces, highlighting a scalable, modular campaign that requires urgent patching and hardening of edge devices.