C0XMO Gafgyt Variant Hidden Payload Execution

Duo Tech@duotech

•updated Jun 3, 2026•0•0•6

Detects the execution of hidden payloads within temporary or shared memory directories (/tmp, /var/tmp, /dev/shm). This behavior is commonly associated with the C0XMO Gafgyt botnet variant, which copies itself to these hidden '.sys' files to maintain persistence and evade detection.