Gayfemboy Malware: Analysis of a Sophisticated DDoS Botnet
First identified in February 2024 by security researchers at Fortinet, Gayfemboy is a potent malware strain that transforms infected machines into a coordinated botnet. The malware gained notoriety following a massive wave of Distributed Denial of Service (DDoS) attacks in January 2024, where it leveraged compromised systems to overwhelm target websites.
Designed for versatility and persistence, Gayfemboy targets a wide array of system architectures, including ARM, MIPS I, PowerPC, and Intel x86. Its operational patterns closely mirror those of the infamous Mirai botnet, focusing on the exploitation of vulnerable network services to expand its reach.
[ไม่มีภาพประกอบ]Key Facts
- Discovery: First detected in February 2024 by Fortinet.
- Primary Goal: Launching DDoS attacks via UDP, TCP, and ICMP protocols.
- Scale: Over 15,000 active nodes by November 2024.
- Primary Vector: Unauthenticated Redis servers on port 6379.
- Persistence: Uses a monitor process to restart itself if terminated.
- Payloads: Includes backdoor access and Monero cryptocurrency miners.
Technical Architecture and Evasion Techniques
Obfuscation and Detection Avoidance
To hinder analysis, Gayfemboy samples are obfuscated using a UPX packer. However, the attackers modified the standard "UPX!" header, replacing it with the hexadecimal code 10 F0 00 00 to bypass simple signature-based detection. The malware also employs unique file naming conventions to remain stealthy on the host system.
Sandbox Evasion and Self-Preservation
The malware utilizes a sophisticated "Monitor" to ensure its survival. It scans the /proc/[PID]/exe and /proc/[PID]/cmdline paths to identify active processes. If it finds matches among 47 specific command strings—such as ls -l, reboot, or wget—it terminates those processes.
Furthermore, Gayfemboy can detect sandbox environments (isolated virtual systems used by researchers) by implementing a precise 50-nanosecond delay. Because most sandboxes cannot manage such a fine-tuned delay, the function fails, triggering a 27-hour dormant state to avoid analysis.
Infection Vector and Propagation
Exploiting Redis Servers
The primary attack vector involves searching for unauthenticated Redis servers (an in-memory data structure store) operating on port 6379. Once found, the malware executes legitimate CONFIG, SET, and SAVE commands to create a malicious cron job. This job runs a shell script that performs the following actions:
- Disables SELinux (Security-Enhanced Linux).
- Implements defense evasion measures.
- Blocks external access to the Redis port to prevent other attackers from hijacking the access route.
- Terminates competing mining processes, such as Kinsing.
Expansion to IoT and Industrial Devices
By November 2024, the botnet expanded its targeting to include smart home devices and industrial routers. By July 2025, FortiGuard Labs identified payloads targeting devices from manufacturers including Asus, Vivo, Zyxel, and Realtek. These attacks often utilized downloader scripts to install the main malware and Monero miners, sometimes bypassing authentication on systems containing the string "meowmeow".
[ไม่มีภาพประกอบ]Botnet Operations and Mitigation
Command and Control (C2)
Gayfemboy binds to UDP port 47272 and connects to remote Command and Control (C2) servers to receive instructions. The operators have even used the botnet to launch DDoS attacks against the very researchers monitoring their activity. The malware is designed to self-terminate if it receives a specific command from the server or detects sandbox manipulation.
Summary of Malware Characteristics
| Feature | Details |
|---|---|
| Target Architectures | ARM, MIPS I, PowerPC, Intel x86 |
| Network Ports | 6379 (Redis), 47272 (UDP) |
| Attack Protocols | UDP, TCP, ICMP |
| Known C2 Domains | cross-compiling.org, i-kiss-boys.com, furry-femboys.top, twinkfinder.nl, 3gipcam.com |
| Payloads | DDoS Bot, Monero Miner, Backdoor |
By August 2025, Fortinet deployed multi-layered protections, including IPS (Intrusion Prevention System) signatures and web filtering to block the identified C2 domains and protect against the exploited vulnerabilities.
Frequently Asked Questions
What is the primary purpose of the Gayfemboy malware?
The primary purpose is to create a botnet of infected devices to launch large-scale DDoS attacks and execute cryptocurrency mining (specifically Monero).
How does Gayfemboy enter a system?
It primarily targets unauthenticated Redis servers on port 6379, using legitimate commands to schedule a malicious shell script via a cron job.
How does the malware avoid being detected by security researchers?
It uses a modified UPX packer to hide its header, monitors for specific system processes to terminate them, and uses a 50-nanosecond timing delay to detect and evade sandbox environments.
Which devices are most at risk from this botnet?
While it targets various architectures, it has specifically focused on industrial routers, smart home devices, and hardware from brands like Asus, Vivo, Zyxel, and Realtek.
What can be done to protect against Gayfemboy?
Protection includes securing Redis servers by requiring authentication, keeping device firmware updated to patch vulnerabilities, and using web filtering and IPS signatures to block known C2 domains.