Evidence indicates that the botnet has been active in the wild since July 2026, exploiting a string of known vulnerabilities in internet-facing devices to install a previously undocumented Linux botnet family researchers are calling Evooo1Bot.
Mirai codebase at the core, Fortinet says
Fortinet FortiGuard Labs, which published the analysis, reports that Evooo1Bot "reuses the DDoS engine from the publicly leaked Mirai source code" while extending that framework with a suite of new capabilities. The firm summarized the additions concisely: "it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities."
Those extensions shift the botnet from a simple DDoS platform into a multi-purpose toolset that can both attack and disguise subsequent activity through compromised edge devices.
Exploited vulnerabilities and the initial attack chain
Fortinet’s report lists a wide set of documented security flaws Evooo1Bot leverages to reach internet-connected routers, IP cameras, firewalls and other edge devices. Successful exploitation leads to execution of a loader script named "wget.sh" hosted on the external IP 91.92.40[.]118, which retrieves a binary compatible with the device CPU and then clears Bash history to remove traces.
- CVE-2007-3010 — Alcatel OmniPCX Enterprise Remote Code Execution
- CVE-2016-6277 — NETGEAR Multiple Routers Remote Code Execution
- CVE-2018-14558 — Tenda AC7, AC9, and AC10 Routers Command Injection
- CVE-2019-14931 — Mitsubishi Electric Europe B.V. ME-RTU devices and INEA ME-RTU devices remote Command Injection
- CVE-2020-10987 — Tenda AC1900 Router AC15 Model Remote Code Execution
- CVE-2021-46422 — Telesquare SDT-CW3B1 Command Injection
- CVE-2022-37055 — D-Link Routers Buffer Overflow
- CVE-2024-29269 — Telesquare TLR-2005KSH Command Injection
- CVE-2025-10123 — D-Link DIR-823X Command Injection
- CVE-2025-55583 — D-Link DIR-868L B1 router Command Injection
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageLoader, C2 behavior and supported commands
After installation the Evooo1Bot binary performs reconnaissance on the host — checking for analysis tools, sandboxes and virtual environments — then establishes encrypted communications with a command-and-control (C2) server on port 443. Fortinet notes the port choice is intentional because it "allows the malware to blend in with expected HTTPS traffic at the network perimeter."
Once a host is registered with the C2 server it awaits commands. Fortinet lists an extensive command set that includes:
- installing persistence mechanisms and updating the binary
- terminating the bot or uploading and downloading files
- opening an interactive shell and intercepting HTTP Basic Authorization and Cookie headers
- turning the host into a proxy node and launching an SSH brute-force scanner
- triggering DDoS attacks over DNS, TCP and UDP
- firing an HTTP-based exploit dispatcher to target known flaws
Fortinet also details a CVE attack module capable of launching exploits against eight additional vulnerabilities affecting specific products and platforms:
- CVE-2021-36260 — Hikvision
- CVE-2022-26134 — Atlassian Confluence
- CVE-2022-29464 — WSO2
- CVE-2022-30525 — Zyxel
- CVE-2023-1389 — TP-Link
- CVE-2024-4577 — PHP
- CVE-2024-10914 — D-Link
- CVE-2025-1974 — Kubernetes
SOCKS5 proxy module: turning routers into relays
One of Evooo1Bot’s notable features is a SOCKS5 proxy component that transforms an infected device into a relay. Fortinet warned: "This capability significantly increases the value of an infected host to attackers." The report explains how the victim's IP address can then be used to disguise malicious traffic, bypass geographic restrictions or provide access to internal networks through a compromised machine.
Fortinet further observed that "in larger botnets, the same functionality could also be used to build a distributed proxy infrastructure, enabling anonymous traffic forwarding or monetization through residential and enterprise proxy services."
What this means for technologists, procurement teams, and end users
Technologists and security teams should monitor for artifacts Fortinet identified — including the loader host 91.92.40[.]118, unusual outbound connections on port 443 to unknown servers, and indicators of post-exploit cleanup such as cleared Bash history. The presence of an active SOCKS5 listener or unexpected proxy traffic from edge devices is a specific sign the device may have been turned into a relay.
Procurement and device-management teams should review exposed devices against the enumerated CVEs and prioritize patching or compensating controls for the models and vendors listed by Fortinet, including multiple Tenda and D-Link router flaws and the other product-specific CVEs identified.
End users and administrators of small office and home office equipment should be aware that commodity devices such as routers and IP cameras can be enlisted as proxy nodes and that credential interception (HTTP Basic Authorization and Cookie headers) is within Evooo1Bot's capabilities.
Fortinet's analysis paints Evooo1Bot as a pragmatic reuse-and-extend campaign: a Mirai-derived DDoS core wrapped in modern persistence, exploitation and proxying features that raise the value of every infected edge device. Defenders now have a specific set of IPs, ports, and CVE fingerprints to hunt for — and attackers have another mechanism to convert exploited devices into anonymizing infrastructure or revenue-generation assets. How rapidly defenders apply patches and detection rules on the enumerated CVEs will shape whether Evooo1Bot remains a localized nuisance or becomes a wider proxy-for-hire network.
Source: https://thehackernews.com/2026/08/evooo1bot-linux-botnet-exploits-known.html
