Key Takeaways
- Evooo1Bot is a newly identified Linux botnet that builds on the leaked Mirai source code but adds encrypted C2, credential sniffing, SSH brute‑force, and a SOCKS5 proxy module.
- It has been active since July 2026, exploiting a wide range of known vulnerabilities in routers, cameras, and edge devices to deliver its payload.
- The botnet uses HTTPS‑port 443 for C2 traffic to blend with legitimate web traffic and evades detection by checking for analysis tools and clearing Bash history.
- Infected hosts can be turned into relay proxies, enabling attackers to mask malicious traffic, bypass geo‑restrictions, and potentially monetize the infrastructure as a residential‑ or enterprise‑proxy service.
- Defenders should patch the listed CVEs, restrict external management interfaces, monitor outbound HTTPS connections to unusual IPs, and deploy behavioral‑based detection for proxy‑like activity.
Introduction and Origin of Evooo1Bot
Evooo1Bot represents a fresh Linux‑based botnet family uncovered by Fortinet FortiGuard Labs in August 2026. While its core DDoS engine is directly borrowed from the publicly leaked Mirai source code, the malware has been substantially extended with a suite of stealth and functionality enhancements. Researchers first observed the botnet in the wild beginning July 2026, when it began scanning the internet for devices exposing known vulnerabilities. By repurposing Mirai’s proven infection chain and augmenting it with modern evasion tactics, the threat actors behind Evooo1Bot have created a versatile platform capable of both disruptive attacks and covert proxy services.
Technical Capabilities and Modifications over Mirai
Beyond Mirai’s basic scanning and flooding routines, Evooo1Bot incorporates several advanced modules. An encrypted command‑and‑control (C2) channel protects communications from casual inspection, while an integrated credential sniffer harvests HTTP Basic Authorization and Cookie headers from compromised hosts. The botnet also ships an SSH brute‑force scanner designed to gain footholds on additional Linux systems, and a flexible exploit arsenal that can launch attacks against a variety of web‑application and device‑specific vulnerabilities. These additions transform Evooo1Bot from a simple DDoS tool into a multi‑purpose intrusion framework.
C2 Communication and Evasion Techniques
The malware establishes its C2 link over TCP port 443, the standard port for HTTPS traffic. This deliberate port choice allows the botnet’s beaconing and command traffic to blend seamlessly with legitimate web traffic at network perimeters, reducing the likelihood of detection by simple port‑based filters. Prior to connecting, the binary performs anti‑analysis checks—scanning for sandboxes, virtual environments, and common debugging tools—and aborts execution if any are detected. After a successful handshake, the host registers with the C2 server and awaits further instructions, all while the initial infection script wget.sh clears the Bash history to erase forensic traces.
Exploit Arsenal and Vulnerability Exploitation
Evooo1Bot’s exploit module targets a broad spectrum of known flaws, enabling it to compromise diverse edge devices. The botnet leverages historic vulnerabilities such as CVE‑2007‑3010 (Alcatel OmniPCX Enterprise) and CVE‑2016‑6277 (NETGEAR routers), as well as more recent issues like CVE‑2024‑29269 (Telesquare TLR‑2005KSH) and CVE‑2025‑55583 (D‑Link DIR‑868L B1). In addition to device‑specific bugs, the framework includes a CVE attack module capable of exploiting eight high‑profile flaws affecting products from Hikvision, Atlassian Confluence, WSO2, Zyxel, TP‑Link, PHP, D‑Link, and Kubernetes. This extensive arsenal ensures that the botnet can find a viable entry point on a large proportion of internet‑facing hardware.
Loader Script and Infection Process
Initial compromise occurs when the botnet exploits one of the listed CVEs to gain remote code execution on a target device. The exploit then downloads and executes a loader shell script named wget.sh hosted at the IP address 91.92.40.118. This script selects the appropriate botnet binary for the device’s CPU architecture, writes it to disk, and runs it. As part of its anti‑forensics routine, wget.sh clears the Bash history before exiting, thereby removing obvious clues of the download and execution chain from the victim’s logs.
Proxy Functionality and SOCKS5 Relay
One of Evooo1Bot’s most notable features is its ability to convert an infected router, firewall, IP camera, or similar edge device into a SOCKS5 proxy. Once activated, the proxy module accepts inbound connections from the attacker and forwards traffic through the compromised host’s IP address. This capability provides several strategic advantages: it disguises the origin of malicious traffic, helps bypass geographic IP‑based restrictions, and can serve as a pivot point for accessing internal networks that are otherwise unreachable from the internet. In large‑scale deployments, the botnet could assemble a distributed proxy infrastructure, which might be monetized by selling access as a residential or enterprise proxy service.
Additional Attack Modules (SSH brute‑force, DDoS, credential sniffing)
Evooo1Bot’s command set enables operators to conduct a variety of follow‑on actions. The SSH brute‑force scanner attempts to guess credentials on exposed SSH services, expanding the botnet’s reach. The integrated DDoS engine can launch attacks over DNS, TCP, and UDP vectors, leveraging the same Mirai‑derived flooding techniques that proved effective in past campaigns. Credential sniffing intercepts HTTP Basic Authorization and Cookie headers from web traffic passing through the host, harvested credentials can then be reused for further compromise or sold on underground markets. Finally, the bot supports file upload/download, binary updates, persistence installation, and an interactive shell, giving attackers full control over each compromised node.
Implications, Defense Recommendations, and Conclusion
The emergence of Evooo1Bot underscores the continued evolution of botnet threats that blend legacy Mirai tactics with modern stealth and monetization strategies. Organizations should prioritize patching the specific CVEs listed in the advisory, disable or restrict remote management interfaces on edge devices, and enforce strong, unique credentials for SSH and web‑based admin consoles. Network‑level monitoring should focus on outbound HTTPS connections to unfamiliar IP addresses, especially those exhibiting periodic beaconing patterns consistent with C2 traffic. Deploying intrusion‑detection systems capable of detecting SOCKS5 proxy behavior and anomalous credential harvesting can provide early warning. By combining timely patch management, hardened device configurations, and behavioral analytics, defenders can mitigate the risk posed by Evooo1Bot and similar multifaceted botnets.