A new modular Linux botnet named Evooo1Bot is actively exploiting internet-facing gateway devices across multiple regions. Also, it turns compromised routers and IoT hardware into SOCKS5 proxy relays for concealed malicious traffic.
What Happened: Evooo1Bot Botnet Hijacks Routers for Proxy Networks and DDoS
Fortinet researchers discovered Evooo1Bot in August 2026. Consequently, telemetry confirms the botnet has been active since at least July 2026. The malware extends the leaked Mirai source code with modern capabilities. Furthermore, it adds encrypted command-and-control communications, credential theft, and an SSH brute-force scanner.
Evooo1Bot targets devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link. Moreover, newer builds expand the exploit arsenal to include Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installations. Therefore, the threat surface is broad and growing.
Technical Details of the Evooo1Bot Malware
Evooo1Bot is a modular Linux malware family. The name derives from the hardcoded string “evooo1” found in every binary. While it reuses Mirai’s DDoS engine, the framework now includes significantly more capabilities.
Exploitation and Delivery
The botnet exploits known vulnerabilities in edge devices. For example, observed CVEs include:
- CVE-2007-3010: Alcatel OmniPCX Enterprise RCE
- CVE-2016-6277: NETGEAR router RCE
- CVE-2018-14558: Tenda AC7, AC9, and AC10 command injection
- CVE-2019-14931: Mitsubishi Electric ME-RTU command injection
- CVE-2020-10987: Tenda AC1900 AC15 RCE
- CVE-2021-46422: Telesquare SDT-CW3B1 command injection
- CVE-2022-37055: D-Link router buffer overflow
- CVE-2024-29269: Telesquare TLR-2005KSH command injection
- CVE-2025-10123: D-Link DIR-823X command injection
- CVE-2025-55583: D-Link DIR-868L B1 command injection
When an exploit succeeds, a shell script downloads one of twelve malware builds matching the host’s CPU architecture. Also, the script clears Bash history to wipe traces. Each exploitation attempt carries a campaign label. Thus, operators track per-vulnerability infection yield independently.
Anti-Analysis and Evasion
Evooo1Bot performs extensive checks before launching. For instance, it searches for debuggers such as GDB, LLDB, strace, and ltrace. Moreover, it detects sandboxes, virtual machines, containers, and honeypots. Strings are protected with AES and ChaCha20 encryption. In addition, keys are split into constants and combined at runtime via XOR.
Persistence Mechanisms
The malware establishes persistence through multiple methods:
- systemd service entries
- SysV init scripts
- Shell profile modifications
- rc.local entries
- A cron job that re-downloads the payload every five minutes
Core Modules
Evooo1Bot includes several integrated modules:
- SOCKS5 Relay: Supports direct listening and reverse-relay modes. Consequently, attackers can conceal traffic and circumvent geographic restrictions.
- Credential Sniffer: Monitors /proc/net/tcp and captures HTTP Basic Authentication and Cookie headers.
- SSH Brute-Force Scanner: Uses 150 username and password combinations. Also, it performs post-login checks to avoid honeypots.
- DDoS Engine: Inherited from Mirai, supporting 16 flood methods. These include UDP, DNS, SYN, ACK, GRE, fragmented TCP, and HTTP floods.
- Interactive Shell: Gives operators direct control over compromised systems with file upload and download support.
C2 communications occur over encrypted channels on port 443. Furthermore, proxying sessions run independently, and multiple can be opened simultaneously.
Business and Operational Impact
Evooo1Bot poses a multi-layered threat to organizations and consumers. For example, compromised residential and enterprise routers can relay traffic for other criminal operations. Moreover, the botnet’s DDoS capabilities threaten service availability.
- Residential proxy abuse: Monetization through proxy services if the botnet scales.
- Network access pivoting: Attackers can reach internal networks through compromised edge devices.
- Credential exposure: HTTP credentials captured from adjacent traffic on infected devices.
- DDoS extortion: 16 flood methods enable large-scale denial-of-service attacks.
Mitigation and Recommendations
Immediate Actions for Defenders
- Update IoT device firmware to the latest vendor-supported version.
- Replace default administrator credentials with strong, unique passwords.
- Disable remote access panels and management interfaces if not required.
- Restrict inbound access to TCP port 5900 and other remote management ports.
- Monitor for cron jobs, systemd services, and rc.local modifications on Linux systems.
- Replace end-of-life devices that no longer receive security updates.
Network Monitoring Guidance
Monitor for outbound connections to suspicious loader URLs and C2 infrastructure. Also, inspect traffic for signs of SOCKS5 relay activity on non-standard ports. Furthermore, look for SSH brute-force attempts from unexpected sources.
Bottom line: Evooo1Bot demonstrates that Mirai-derived threats continue to evolve with modern evasion, encryption, and monetization features. Therefore, patching edge devices and disabling unnecessary remote access remain essential defenses.
Incident Summary
| Incident: | Evooo1Bot Linux Botnet |
| First Observed: | July 2026 |
| Disclosed: | August 13, 2026 (Fortinet) |
| Affected Systems: | Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link routers, Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS, WSO2, Kubernetes ingress-nginx, PHP-CGI |
| Primary Threats: | SOCKS5 proxy relay, DDoS, credential theft, SSH brute-force |
| Patch Status: | Address underlying CVEs; no single patch for the botnet itself |
| Severity: | Critical |
References
- Fortinet FortiGuard Labs, “Multi-Functional Linux Botnet ‘Evooo1Bot’,” August 13, 2026, https://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot (accessed August 15, 2026).
- BleepingComputer, “New Evooo1Bot Linux botnet turns routers into traffic relay nodes,” August 15, 2026, https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes/ (accessed August 15, 2026).
- InfoSecurity Magazine, “New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies,” August 14, 2026, https://www.infosecurity-magazine.com/news/new-linux-botnet-evooo1bot-victims/ (accessed August 15, 2026).
