A sophisticated new Linux botnet malware, dubbed Evooo1Bot, has been actively targeting internet-facing gateway devices since at least July, repurposing them as SOCKS5 traffic relay nodes while expanding its capabilities well beyond the original Mirai source code upon which it is built. Discovered by Fortinet researchers, this modular malware represents a significant evolution in IoT botnet threats, combining credential theft, SSH brute-forcing, and distributed denial-of-service (DDoS) attack capabilities with an encrypted command-and-control (C2) infrastructure and a dedicated exploit arsenal targeting dozens of known vulnerabilities across devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link.
Evooo1Bot: A Modular Linux Botnet Built on Mirai’s DDoS Engine
Evooo1Bot is a Mirai-based Linux botnet that first came to light in July 2026, though its development may have begun earlier. The malware reuses the DDoS engine from the publicly leaked Mirai source code, a foundational piece of malware that has spawned countless botnets since 2016. However, Evooo1Bot extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities. Newer builds include a separate vulnerability-exploitation module aimed at Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installations. Fortinet notes that some of the embedded exploits are not correctly implemented, leading to failed exploitation attempts, but the overall threat remains significant.
What is Evooo1Bot and how does it work?
Evooo1Bot is a Linux botnet malware that infects internet-facing gateway devices, such as routers and IoT devices, by exploiting known vulnerabilities. Once infected, it establishes persistence through systemd, SysV init, shell profiles, and rc.local, and re-downloads its payload every five minutes via a cron job. The malware uses encrypted C2 communications over port 443, performs extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots before activation, and clears Bash history to wipe traces of the attack. It then loads modular components, including an interactive shell, a credential sniffer, an SSH brute-forcer, a SOCKS5 relay, and a DDoS engine supporting 16 flood methods.
Geographical Spread and Targeted Devices
According to Fortinet’s telemetry, Evooo1Bot has been observed spreading across multiple regions, with a notable concentration in Asia, Europe, and North America. The map of current geographical spread shows infections in countries including the United States, China, India, Japan, South Korea, Germany, the United Kingdom, France, Italy, Spain, Russia, Brazil, and others. The malware targets devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link by exploiting known vulnerabilities—many of which are publicly documented and may have patches available. However, the attack surface remains large because many devices are no longer supported by their vendors or have not been updated by users.
Modular Architecture: Beyond Simple DDoS
Evooo1Bot’s modular design sets it apart from earlier Mirai variants. The malware’s modules include:
- Interactive Shell: Gives operators direct control over compromised systems, allowing execution of arbitrary commands.
- File Transfer: Supports upload and download of files to and from the infected device.
- Credential Sniffer: Monitors
/proc/net/tcpcodecodecodecode and attempts to capture HTTP Basic Authentication and Cookie headers, enabling theft of login credentials from network traffic. - SSH Scanner Module: Uses 150 username and password combinations targeting enterprise-oriented accounts, and performs post-login checks to avoid honeypots.
- SOCKS5 Relay Module: Supports direct listening and reverse-relay modes, allowing attackers to conceal malicious traffic, circumvent geographic restrictions, or access networks through compromised systems. Multiple proxy sessions can run simultaneously, potentially enabling monetization through residential proxy services if the botnet grows large enough.
- DDoS Module: Inherited from Mirai, supports 16 flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and an HTTP flood with customizable requests.
- Exploit Module: Targets vulnerabilities in Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and PHP-CGI installations.
This modularity allows Evooo1Bot to be used for multiple purposes simultaneously—from credential harvesting and network intrusion to DDoS attacks and proxy services—making it a versatile tool for cybercriminals.
How Evooo1Bot Achieves Persistence and Evades Detection
Persistence is a key feature of Evooo1Bot. The malware establishes itself on infected devices through systemd services, SysV init scripts, shell profiles, and rc.local. Additionally, a cron job is set to re-download the payload every five minutes, ensuring that even if the malware is removed manually, it will be reinstalled quickly. The malware also clears Bash history after execution to hide traces of the attack. Before launching its payload, Evooo1Bot performs extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots. This anti-analysis capability makes it harder for security researchers and automated systems to detect and study the malware.
Infection Vector: Exploiting Known Vulnerabilities
When a device is found to be vulnerable, an exploit script is executed that downloads one of the 12 available malware builds matching the host’s CPU architecture. The builds are pre-compiled for different architectures, including ARM, MIPS, x86, and others commonly found in embedded devices. The malware does not automatically spread by itself; instead, it relies on the initial exploitation to gain a foothold. Once inside, it can then use its SSH brute-forcer to propagate to other devices on the same network or over the internet, using the stolen credentials from the sniffer module. The exploit module targets specific vulnerabilities, some of which are several years old, underscoring the importance of patching and firmware updates.
Why the SOCKS5 Relay Module Matters
The SOCKS5 relay module is one of the most concerning features of Evooo1Bot. It allows the botnet operator to route internet traffic through infected devices, effectively turning them into residential proxies. This can be used to anonymize malicious activities, such as launching attacks, accessing restricted content, or conducting fraud. Because the traffic originates from a legitimate residential IP address, it is less likely to be blocked by security filters. Fortinet notes that proxy sessions run independently and multiple can be opened simultaneously, making the botnet potentially valuable as a residential proxy service. If the botnet grows large enough, the operator could monetize it by selling proxy access to other criminals.
Credential Theft and SSH Brute-Forcing
Evooo1Bot’s credential sniffer module monitors network traffic for HTTP Basic Authentication and Cookie headers, capturing usernames and passwords as they are transmitted over the network. This is a classic man-in-the-middle attack that can harvest credentials for web applications, email, and other services. The SSH scanner module uses 150 username and password combinations, focusing on enterprise-oriented accounts (e.g., admin, root, support, etc.). After successful login, it performs checks to avoid honeypots, indicating that the malware is designed to evade detection and maximize its spread. The combination of sniffer and scanner means that Evooo1Bot can both harvest existing credentials and attempt to brute-force new ones, expanding its reach within and across networks.
DDoS Capabilities: 16 Flood Methods
The DDoS module inherited from Mirai is a powerful tool for launching volumetric attacks. With 16 flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and an HTTP flood with customizable requests, Evooo1Bot can target a wide range of services and protocols. The HTTP flood is particularly dangerous because it can mimic legitimate traffic, making it harder to mitigate. The modular design allows the operator to select the appropriate attack method for the target, increasing the effectiveness of the botnet for hire or for personal use.
Evooo1Bot vs. Earlier Mirai Variants: What’s New?
While many Mirai variants have appeared over the years, Evooo1Bot stands out for its combination of features. Most Mirai clones are focused solely on DDoS attacks. Evooo1Bot, however, includes encrypted C2 communications, a credential sniffer, an SSH brute-forcer, and a SOCKS5 relay—all in one package. The inclusion of a separate exploit module that targets vulnerabilities in enterprise software like Atlassian Confluence and Kubernetes ingress-nginx suggests that the botnet’s operators are interested in compromising not just home routers but also corporate networks. The anti-analysis checks and persistence mechanisms are also more sophisticated than those found in many earlier Mirai variants.
How to Defend Against Evooo1Bot and Similar Botnets
To protect against Evooo1Bot and other IoT botnets, users and organizations should take the following steps:
- Keep firmware updated: Regularly check for and install firmware updates from device manufacturers. Many of the vulnerabilities exploited by Evooo1Bot have known patches.
- Replace default admin credentials: Change the default username and password on all internet-facing devices. Use strong, unique passwords.
- Turn off remote access panels: Disable remote administration interfaces (such as Telnet, SSH, and web-based management) unless absolutely necessary. If remote access is required, use VPNs or restrict access by IP address.
- Replace unsupported devices: If a device is no longer receiving security updates from the vendor, it should be replaced with a supported model.
- Monitor network traffic: Look for unusual outbound connections, especially on port 443 (HTTPS) that may indicate encrypted C2 traffic. Use network monitoring tools to detect anomalies.
- Segment networks: Place IoT devices on a separate VLAN from critical systems to limit the impact of a compromise.
- Use strong authentication: Implement multi-factor authentication where possible, especially for SSH and web interfaces.
Strategic Implications for Network Security
The emergence of Evooo1Bot highlights the growing sophistication of botnet malware and the shift from simple DDoS-for-hire services to multi-purpose criminal tools. The ability to turn infected devices into SOCKS5 proxies opens up a new revenue stream for attackers, reducing their reliance on DDoS attacks alone. The encrypted C2 communications make it harder for network defenders to identify and block command-and-control traffic. The credential sniffer and SSH brute-forcer allow the botnet to pivot from one infected device to others, potentially compromising entire networks. For organizations, this means that a single unpatched router can become a gateway for data theft, lateral movement, and resource abuse.
As the botnet continues to evolve, it is likely that additional modules and exploits will be added. The Fortinet report notes that some exploits are not correctly implemented, but this is a common pattern in early-stage malware; corrections will likely follow. The botnet’s operators appear to be actively developing and testing new capabilities, making Evooo1Bot a threat to watch closely.
Ultimately, the best defense remains proactive device management and network hygiene. The vulnerabilities exploited by Evooo1Bot are not zero-days; they are known weaknesses that have been patched by vendors. The challenge is that many devices remain unpatched or are no longer supported. Users and enterprises must take responsibility for the security of their internet-facing devices, or risk becoming part of a botnet that can be used to attack others or facilitate cybercrime.
