Cybersecurity experts have raised concerns over a new Linux botnet family named Evooo1Bot, which leverages the Mirai botnet’s source code to transform internet-connected devices into SOCKS5 proxies. This botnet utilizes known security flaws to infiltrate devices and extend its functionalities.
Key Features of Evooo1Bot
Evooo1Bot has been active since July 2026, according to Fortinet FortiGuard Labs. It repurposes the DDoS engine from Mirai and enhances it with additional features such as encrypted command-and-control (C2) communications, an SSH brute-force scanner, and a credential sniffer. These capabilities allow the botnet to exploit multiple vulnerabilities in devices that are publicly accessible.
The botnet targets a variety of security flaws including CVE-2007-3010, CVE-2016-6277, and CVE-2018-14558, among others. These vulnerabilities span across various routers and devices from companies like Alcatel, NETGEAR, and Tenda, posing a broad threat spectrum.
Infiltration and Operations
Once a device is compromised, the botnet executes a shell script from an external server, which downloads the appropriate binary compatible with the device’s architecture. To maintain stealth, the script deletes Bash history to remove any attack traces. The bot then establishes encrypted communications over port 443, mimicking standard HTTPS traffic to avoid detection.
After establishing a connection with its C2 server, Evooo1Bot executes various commands, including persistence installation, binary updates, and file transfers. The botnet can also intercept HTTP headers, run an SSH brute-force scanner, and initiate DDoS attacks through DNS, TCP, and UDP protocols.
Implications of Proxy Capabilities
The botnet’s ability to convert infected devices into SOCKS5 proxies adds significant value to attackers. This functionality allows attackers to mask malicious activities, circumvent geographic restrictions, and access internal networks through compromised devices. Fortinet highlights that this capability can also facilitate the creation of a distributed proxy network for anonymous traffic forwarding.
By transforming edge devices into part of a proxy infrastructure, Evooo1Bot poses a substantial threat, enhancing the attacker’s ability to conduct further operations undetected. This development underscores the need for robust cybersecurity measures to protect vulnerable devices from exploitation.
As the threat landscape evolves, staying informed about emerging threats like Evooo1Bot is crucial for maintaining cybersecurity defenses. Organizations are urged to patch known vulnerabilities and implement comprehensive security strategies to safeguard their networks.
