Competitor Botnet Persistence Removal

Duo Tech@duotech

•updated Jun 3, 2026•0•0•5

Detects the use of sed commands to delete specific competitor botnet entries (e.g., mirai, gafgyt) from system persistence files like crontab or rc.local, a key defense evasion and competitor killing tactic of C0XMO.