Data by Hatching Triage IotLinuxNetwork Device

Gafgyt

Gafgyt, also widely known as BASHLITE, is a long-running Linux and IoT botnet malware family primarily used to conscript vulnerable devices into distributed denial-of-service operations.

Profile source: Mallory

Gafgyt

Family profile

Gafgyt, also widely known as BASHLITE, is a long-running Linux and IoT botnet malware family primarily used to conscript vulnerable devices into distributed denial-of-service operations. It has historically targeted embedded Linux systems such as routers, cameras, DVRs, and other internet-exposed appliances, and newer variants have also been observed targeting enterprise-facing Linux infrastructure and AI development servers. The family is notable for extensive code reuse and branching, with many variants and related strains sharing overlapping functionality, exploit modules, and infrastructure patterns.

Gafgyt commonly gains initial access by exploiting known vulnerabilities in exposed devices and services, and some variants also use credential attacks against weakly secured remote administration interfaces. Observed campaigns have targeted router and IoT flaws as well as enterprise software vulnerabilities, including exploitation of Langflow remote code execution to deploy a stripped-down DDoS-focused payload on x86_64 Linux servers, exploitation of older SonicWall GMS vulnerabilities, and exploitation of DD-WRT UPnP flaws by the C0XMO variant. Several variants deliver architecture-specific Linux binaries to maximize infection success across heterogeneous hardware.

Its core purpose is botnet enrollment and remote attack execution. Gafgyt variants typically connect to command-and-control infrastructure and await instructions to launch network flooding attacks. Documented capabilities include multiple DDoS methods such as UDP, TCP, SYN, ICMP, HTTP-layer floods, HOLD-style attacks, and amplification techniques in some variants. Certain branches also include scanning modules, update mechanisms, process killing to remove competing malware, and persistence through cron jobs, shell profile modification, hidden copies, or watchdog-style relaunch behavior. Other observed variants are more minimal and omit persistence, lateral movement, or secondary monetization features in favor of pure flooding capability.

The malware family has been linked over time to a broad ecosystem of criminal botnet activity rather than a single stable operator. Variants and derivative botnets such as C0XMO, TerraBot, and other Gafgyt-based strains have been observed in campaigns targeting unmanaged IoT fleets, small-office and home-office equipment, and occasionally enterprise systems. Gafgyt remains relevant because old source code, modular reuse, and the continued exposure of unpatched Linux-based devices allow operators to rapidly adapt the family to new exploits and targets.

Capabilities

Brute Force
Ddos
Defense Evasion
Initial Access
Persistence
Scanning

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Aug 12

Observed infrastructure

Last seven days

First activity: Aug 13, 2026
Last activity: Aug 13, 2026
Feed role: C2 / Distribution
Host form: 2 IP / 0 hostnames

Leading locations

Leading providers

Virtual Machine Solutions LLC1
VpsQuan L.L.C.1

Infrastructure traits

Hosting 2

Samples

Recent associated samples

1ece38f76d2242025915a4c8e1373d07b372f4d54844dfe1d1fc4568bdbf0f4b

Observed Aug 13, 2026Triage

32f28732b38c43553192b27e648c079b1cbd24372426083ebc6ab96065ed577b

Observed Aug 13, 2026Triage

5d69b801926d789d11b2d77e01c6fc6c0939a7fe070d5a31dc00c99d754db43a

Observed Aug 13, 2026Triage

93b2b10275c52ea32e58e6265bbbbbef309283c2193f193c288443e1560651f7

Observed Aug 13, 2026Triage

ee223d4c46acb576bb9d3a0f371431cbbc1336ecf403dd75ab3a073fe7f3c811

Observed Aug 13, 2026Triage

02d70eb6accd3567b63b1841e22c9646dabca3f01ab8eb021a2e666e4e0fa233

Observed Aug 13, 2026Triage

07d24f98d34ebcd0e8fe40ea9218805c94dd500e4ed3c3a0cebf79692aa53802

Observed Aug 13, 2026Triage

408026ea525490fd64312ace9e65d433ce6f0f43f3ae833834261aade507c2d6

Observed Aug 13, 2026Triage

4fc97f256de9e479b9befc4de3afa6a9236672605f3215e37869ae173fb6b281

Observed Aug 13, 2026Triage

b8c508760c9a35304b17ac4156b93ee76b6b57bb05e2426c5f9912b65ffea0bd

Observed Aug 13, 2026Triage

Exploited software

Vulnerabilities linked to Gafgyt

17 CVEs

CVE-2025-3248 Unauthenticated RCE in Langflow /api/v1/validate/code CVE-2021-27137 DD-WRT UPnP ssdp_msearch Stack-Based Buffer Overflow CVE-2016-15047 Authenticated OS Command Injection in AVTECH CloudSetup.cgi CVE-2025-34054 Unauthenticated Command Injection in AVTECH DVR Search.cgi CVE-2015-2051 D-Link DIR-645 HNAP GetDeviceSettings Command Injection CVE-2022-35914 PHP Code Injection in GLPI htmLawedTest.php CVE-2023-1389 Unauthenticated Command Injection in TP-Link Archer AX21 Locale API CVE-2017-17215 Remote Code Execution in Huawei HG532 SOAP Service CVE-2018-9866 RCE in SonicWall Global Management System XML-RPC set_time_config CVE-2022-22954 VMware Workspace ONE Access and Identity Manager Server-Side Template Injection RCE CVE-2017-9841 PHPUnit eval-stdin.php Remote Code Execution CVE-2022-22947 Spring Cloud Gateway Actuator Code Injection RCE CVE-2024-3721 OS Command Injection in TBK DVR-4104 and DVR-4216 CVE-2021-3129 Laravel Ignition Debug Mode Remote Code Execution CVE-2022-47945 ThinkPHP lang parameter LFI to RCE CVE-2021-35394 Unauthenticated RCE in Realtek Jungle SDK UDPServer (MP Daemon) CVE-2025-55182 React2Shell

MITRE ATT&CK

Gafgyt in ATT&CK

34 distinct techniques

Techniques

34 techniques

T1059.006 Python T1001 Data Obfuscation T1105 Ingress Tool Transfer T1203 Exploitation for Client Execution T1498 Network Denial of Service T1059 Command and Scripting Interpreter T1071 Application Layer Protocol T1190 Exploit Public-Facing Application T1499 Endpoint Denial of Service T1053.003 Cron T1083 File and Directory Discovery T1046 Network Service Discovery T1057 Process Discovery T1564.001 Hidden Files and Directories T1037 Boot or Logon Initialization Scripts T1110 Brute Force T1489 Service Stop T1570 Lateral Tool Transfer T1021 Remote Services T1070 Indicator Removal T1036 Masquerading T1210 Exploitation of Remote Services T1496 Resource Hijacking T1498.001 Direct Network Flood T1499.003 Application Exhaustion Flood T1584.005 Botnet T1078.001 Default Accounts T1518 Software Discovery T1562 Impair Defenses T1059.004 Unix Shell T1021.004 SSH T1571 Non-Standard Port T1572 Protocol Tunneling T1071.001 Web Protocols

Reporting

Research mentioning Gafgyt

Jul 22

Security Online Info

Gafgyt Botnet Hijacks Langflow for DDoS Attacks

Attackers are actively exploiting CVE-2025-3248, a remote code execution flaw in Langflow’s code validation API, to compromise internet-exposed AI development servers and deploy a customized Gafgyt/BASHLITE malware variant on x86_64 Linux systems. Akamai reported that the intrusion chain uses untrusted Python execution to fetch a Linux binary from a staging server, launch it from a temporary directory, and turn the host into a bot focused on distributed denial-of-service activity rather than cryptomining, persistence, or lateral movement. The malware reportedly supports multiple flood modes, including UDP, TCP, HOLD, and junk/STD, and uses a modified RC4-based cipher to obscure command-and-control traffic and hinder standard decoding. CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog, while GreyNoise observed hundreds of exploit source IPs targeting the flaw. Defenders are being urged to patch Langflow, isolate AI development environments, place exposed instances behind a WAF, enforce outbound filtering including blocking unauthorized traffic such as port 1337, and deploy YARA detections keyed to the malware’s distinctive cipher seed bytes.

Jul 21

Security Online Info

TuxBot v3 Evolution: LLM-Built IoT Botnet Exposed

Palo Alto Networks Unit 42 reported on TuxBot v3 Evolution, a previously undocumented modular IoT botnet framework that can infect devices, maintain persistence, communicate over encrypted command-and-control channels, and launch distributed denial-of-service attacks across 17 CPU architectures. Researchers recovered the botnet’s source code, compiled binaries, Docker-based test infrastructure, and 254 DDoS benchmark reports, showing active development and testing into early 2026. The malware’s working capabilities include Telnet brute-forcing with 1,496 credentials, SSH, HTTP, and ADB scanning, plus fallback mechanisms such as a domain generation algorithm and peer-to-peer gossiping. The report said the framework appears to have been developed with heavy LLM assistance, which introduced several implementation flaws, including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake Argon2id routine that actually behaves like repeated SHA-256 hashing similar to PBKDF2. Despite those defects, Unit 42 assessed the botnet as operationally dangerous because its core infection and DDoS functions work, and the bugs are relatively easy to correct. Telemetry linked the malware to active infrastructure including a command-and-control server at 209.182.237[.]133 and a dropper at 185.10.68[.]127, with reported ties to the Keksec/Kaitori and AISURU ecosystems.

Jul 16

Scworld