Gafgyt

Gafgyt, also widely known as BASHLITE, is a long-running Linux and IoT botnet malware family primarily used to conscript internet-exposed devices into distributed denial-of-service operations. It has historically targeted routers, cameras, DVRs, embedded Linux systems, and other poorly secured network-connected appliances, and has appeared under multiple related names in reporting, including Bashlite. The family has remained active through numerous forks and customized variants, including campaigns that target both consumer IoT and older enterprise-facing infrastructure.

Gafgyt commonly gains initial access by exploiting known vulnerabilities in exposed devices and services, and by abusing weak or default credentials on remote administration interfaces such as Telnet and SSH. Reported variants have targeted a wide range of flaws in routers, DVRs, DD-WRT firmware, SonicWall Global Management System, TP-Link Archer routers, Langflow deployments, and other internet-facing systems. Some variants use separate scanning or propagation components to identify vulnerable hosts, brute-force credentials, exploit HTTP-exposed services, or abuse exposed Android Debug Bridge interfaces, then deliver architecture-specific Linux payloads.

Once installed, Gafgyt variants typically connect to command-and-control infrastructure and await instructions to launch denial-of-service attacks. Observed capabilities include multiple flood techniques across UDP, TCP, SYN, ICMP, amplification, and HTTP-layer methods. Certain variants also implement persistence through hidden copies, cron jobs, shell profile modification, and self-relaunch behavior, while some aggressively kill competing malware and remove rival persistence artifacts to monopolize infected hosts. Defense-evasion measures such as encrypted or obfuscated command-and-control traffic have also been documented in newer customized builds.

The malware family is strongly associated with botnet activity across Linux-based embedded and IoT environments and has repeatedly been linked to large-scale DDoS campaigns. It has also served as a codebase for derivative botnets and variants used by multiple threat actors, including operations tied to broader IoT botnet ecosystems. Over time, Gafgyt-derived activity has reflected a shift from opportunistic compromise of consumer devices toward exploitation of unpatched enterprise and development infrastructure when such systems expose remotely reachable flaws.