C0XMO Botnet: Detecting DD-WRT Exploitation and Rival Malware Termination

---
title: C0XMO Botnet - Suspicious iptables Input Chain Drop
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects attempts to block ports commonly used by rival botnets (Telnet/HTTP) which is a behavior observed in C0XMO variants to kill competing malware.
references:
 - https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.defense_evasion
 - attack.t1562.004
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   Image|endswith:
     - '/iptables'
     - '/busybox'
   CommandLine|contains:
     - '-A INPUT'
     - '-I INPUT'
   CommandLine|contains:
     - '-j DROP'
     - '-j REJECT'
   CommandLine|contains:
     - '--dport 23'
     - '--dport 80'
     - '--dport 8080'
 condition: selection
falsepositives:
 - Legitimate firewall administration blocking management interfaces from WAN
level: high
---
title: C0XMO Botnet - Multi-Arch Binary Download
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Detects the download of binaries to temporary directories on Linux routers, a common stage in C0XMO infection chains.
references:
 - https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.initial_access
 - attack.t1105
logsource:
 category: process_creation
 product: linux
detection:
 selection_tool:
   Image|endswith:
     - '/wget'
     - '/curl'
     - '/tftp'
 selection_dest:
   CommandLine|contains:
     - '/tmp/'
     - '/var/tmp/'
     - '/dev/shm/'
   CommandLine|contains:
     - '.mips'
     - '.arm'
     - '.x86'
     - '.sh4'
 condition: all of selection_*
falsepositives:
 - Legitimate system updates or package installations
level: medium

// Hunt for suspicious iptables modifications indicative of C0XMO rival killing
Syslog
| where ProcessName in ("iptables", "busybox")
| where SyslogMessage has "-A INPUT" and (SyslogMessage has "-j DROP" or SyslogMessage has "-j REJECT")
| where SyslogMessage has_any ("--dport 23", "--dport 80", "--dport 8080")
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| extend IoC = "iptables_drop_rule"
// Hunt for binary downloads to /tmp common in IoT botnets
Syslog
| where ProcessName in ("wget", "curl", "busybox", "tftp")
| where SyslogMessage has "/tmp/" or SyslogMessage has "/var/tmp/"
| where SyslogMessage matches regex @"\.(mips|arm|x86|sh4|ppc)"
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| extend IoC = "binary_download"

-- Hunt for C0XMO indicators: Suspicious processes and iptables rules
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ "iptables" 
   AND CommandLine =~ "-j (DROP|REJECT)" 
   AND CommandLine =~ "--dport (23|80|8080)"

SELECT Pid, Name, Exe, CommandLine
FROM pslist()
WHERE Exe =~ "/tmp/.*\.(mips|arm|sh4|x86)" 
   OR Exe =~ "/var/.*\.(mips|arm|sh4|x86)"

-- Check for established network connections to non-standard high ports (potential C2)
SELECT Fd, Family, RemoteAddr, RemotePort, State
FROM listen_sockets()
WHERE RemotePort > 1024 AND State = "ESTABLISHED"

#!/bin/bash
# Remediation script for C0XMO/Gafgyt infections on DD-WRT/Linux routers
# Run with root privileges

echo "[*] Starting C0XMO Remediation Check..."

# 1. Identify and kill suspicious processes in /tmp or /var
echo "[+] Scanning for suspicious malicious processes..."
MALICIOUS_PIDS=$(ps aux | grep -E '(wget|curl|tftp|/tmp/|/var/)' | grep -E '\.(mips|arm|sh4|x86)' | grep -v grep | awk '{print $2}')

if [ -n "$MALICIOUS_PIDS" ]; then
    echo "[!] Killing potential botnet PIDs: $MALICIOUS_PIDS"
    kill -9 $MALICIOUS_PIDS
else
    echo "[+] No suspicious processes found."
fi

# 2. Remove malicious binaries from common drop locations
echo "[+] Cleaning up malicious binaries in /tmp and /var..."
find /tmp -type f -name '*.*' -exec file {} \; | grep -i 'elf' | cut -d: -f1 | xargs -r rm -f
find /var -type f -name '*.*' -exec file {} \; | grep -i 'elf' | cut -d: -f1 | xargs -r rm -f

# 3. Reset iptables to a safe default (Adjust ports according to your policy)
echo "[+] Flushing iptables to remove rival blocking rules..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
# Re-enable basic stateful firewalling
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
# Block inbound management from WAN (Example: eth1 is WAN)
# iptables -A INPUT -i eth1 -p tcp --dport 80 -j DROP
# iptables -A INPUT -i eth1 -p tcp --dport 23 -j DROP

echo "[*] Remediation complete. Please verify firmware version and change credentials."