Threat Summary
Recent OTX pulses indicate a convergence of credential theft and infrastructure hijacking campaigns. We observe the BoryptGrab Stealer being distributed via sophisticated GitHub impersonation and SEO poisoning, specifically targeting developers and security-conscious users with DLL side-loading techniques. Simultaneously, a new Gafgyt variant (C0XMO) is actively exploiting vulnerabilities in DD-WRT routers to establish a cross-platform botnet, utilizing Python scripts for lateral movement across ARM, MIPS, and x86 architectures.
Parallel to these technical attacks, a massive Smishing operation (Error 524 Decoy) and gaming-focused phishing campaigns (Roblox/Minecraft) are harvesting credentials on a global scale, targeting telecommunications, finance, and education sectors. The collective objective appears to be building a robust infrastructure for DDoS (Gafgyt) while monetizing stolen credentials via infostealers (BoryptGrab) and phishing-as-a-service (PaaS).
Threat Actor / Malware Profile
BoryptGrab Stealer
- Distribution Method: GitHub impersonation of legitimate security vendors (e.g., Arctic Wolf) and fake repositories offering cracked software. Malicious links lead to ZIP archives containing executables.
- Payload Behavior: Information stealer targeting browser data, system info, and authentication tokens.
- C2 Communication: Establishes connections to actor-controlled infrastructure to exfiltrate harvested data.
- Persistence Mechanism: Likely utilizes DLL side-loading or scheduled tasks (standard for commodity stealers).
- Anti-Analysis: Uses disguised payloads within archives to evade basic static analysis.
Gafgyt (C0XMO Variant)
- Distribution Method: Exploits stack buffer overflow vulnerabilities in DD-WRT firmware (CVE-2015-2051, CVE-2022-35914).
- Payload Behavior: DDoS botnet with separated lateral movement capabilities.
- C2 Communication: Connects to hardcoded C2 IPs (e.g., 217.160.125.125) for command execution.
- Persistence Mechanism: Infects router firmware; cron jobs or init scripts on Linux/IoT devices.
- Anti-Analysis: Uses standalone Python scripts for scanning, obscuring the binary's core logic.
IOC Analysis
The provided IOCs include IPv4 addresses associated with C2 infrastructure and phishing hosting, Domain names utilizing typosquatting (e.g., roblox-com.com), and FileHash-MD5 signatures for the malicious binaries.
SOC teams should operationalize these by:
- Blocking the listed IPs and domains at the perimeter and proxy level.
- Scanning endpoint environments for the specific MD5 hashes provided (e.g.,
1cd9eccc8e73d60164390beddf4cdc48). - Hunting for network connections to the non-standard IP ranges associated with the smishing botnet.
Tooling Recommendations: Use SIEM correlation rules for the IPs, EDR for file hash blacklisting, and DNS sinkholing for the typosquatted domains.
Detection Engineering
Sigma Rules
YAML
title: Potential BoryptGrab Stealer Execution via DLL Side-Loading
id: 1a2b3c4d-5e6f-7890-abcd-ef1234567890
description: Detects execution patterns associated with BoryptGrab and similar stealers utilizing DLL side-loading, often initiated by script interpreters or renamed binaries.
status: experimental
date: 2026/07/04
author: Security Arsenal
references:
- https://arcticwolf.com/resources/blog/security-bulletin-github-impersonation-deploys-information-stealer/
tags:
- attack.defense_evasion
- attack.t1574.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- '\python.exe'
- '\powershell.exe'
- '\cmd.exe'
- '\mshta.exe'
Image|endswith:
- '\rundll32.exe'
- '\regsvr32.exe'
filter_generic:
CommandLine|contains:
- 'javascript:'
- 'vbscript:'
condition: selection and not filter_generic
falsepositives:
- Legitimate software installers
level: high
---
title: Gafgyt C0XMO Router Exploit and Lateral Movement
id: 2b3c4d5e-6f78-90ab-cdef-1234567890ab
description: Detects potential Gafgyt C0XMO activity involving Python scanners and exploitation of known DD-WRT CVEs on Linux/Unix systems.
status: experimental
date: 2026/07/04
author: Security Arsenal
references:
- https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo
tags:
- attack.initial_access
- attack.t1190
- attack.lateral_movement
logsource:
category: process_creation
product: linux
detection:
selection_python:
Image|endswith: '/python'
CommandLine|contains:
- 'scanner'
- 'exploit'
selection_cve:
CommandLine|contains:
- 'CVE-2015-2051'
- 'CVE-2022-35914'
selection_network:
CommandLine|contains:
- '217.160.125.125'
- '85.215.131.70'
condition: 1 of selection*
falsepositives:
- Legitimate security scanning
level: high
---
title: Smishing Botnet C2 Connection Detection
id: 3c4d5e6f-7890-abcd-ef1234567890bc
description: Detects outbound network connections to known IP addresses associated with the Error 524 Decoy smishing operation.
status: experimental
date: 2026/07/04
author: Security Arsenal
references:
- https://www.group-ib.com/blog/error-524-decoy-smishing/
tags:
- attack.command_and_control
- attack.t1071.001
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationIP|contains:
- '43.159.168.186'
- '43.162.84.202'
- '45.135.162.90'
- '8.222.134.149'
condition: selection
falsepositives:
- Rare legitimate connections to cloud infrastructure hosted on these IPs
level: critical
KQL (Microsoft Sentinel)
KQL — Microsoft Sentinel / Defender
// Hunt for connections to known malicious IPs from Smishing and Gafgyt campaigns
DeviceNetworkEvents
| where RemoteIP in ("217.160.125.125", "85.215.131.70", "43.159.168.186", "43.162.84.202", "45.135.162.90", "8.222.134.149", "45.11.229.230")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc
PowerShell Hunt Script
PowerShell
# IOC Hunt Script for BoryptGrab and Gaming Phishing Domains
# Checks for specific file hashes and Hosts file modifications
$MaliciousHashes = @(
"1cd9eccc8e73d60164390beddf4cdc48", # Gafgyt C0XMO
"b98575f3c0259b480a31b917aa73bc56", # BoryptGrab
"fd01262bd56510088b9ddfe58ca101ab" # BoryptGrab
)
$MaliciousDomains = @(
"roblox-com.com",
"blox.ink",
"bloxlink.net",
"robiox.com.ua"
)
Write-Host "[+] Scanning for malicious file hashes..."
foreach ($hash in $MaliciousHashes) {
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
ForEach-Object {
$fileHash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
if ($fileHash -eq $hash) {
Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) with hash $hash" -ForegroundColor Red
}
}
}
Write-Host "[+] Checking Hosts file for phishing domains..."
$HostsPath = "$env:windir\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
$HostsContent = Get-Content $HostsPath
foreach ($domain in $MaliciousDomains) {
if ($HostsContent -match $domain) {
Write-Host "[!] SUSPICIOUS ENTRY IN HOSTS FILE: $domain detected." -ForegroundColor Yellow
}
}
}
Write-Host "[+] Scan complete."
Response Priorities
-
Immediate:
- Block all listed IPv4 addresses and domains at the firewall and proxy.
- Quarantine any endpoints matching the provided MD5 file hashes.
- Takedown any Wi-Fi routers running vulnerable DD-WRT firmware (patch CVE-2015-2051, CVE-2022-35914).
-
24h:
- Initiate credential resets for users who may have interacted with the fraudulent GitHub repositories or smishing links.
- Review logs for outbound connections to the C2 IPs indicating successful data exfiltration.
-
1 week:
- Update security awareness training to cover the "Error 524" smishing tactic and GitHub impersonation.
- Enforce strict router firmware update policies for edge devices and IoT segments.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
darkwebotx-pulsedarkweb-credentialsboryptgrab-stealergafgyt-botnetsmishingcredential-theftsocial-engineering
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.