What Evooo1Bot does on infected devices
Evooo1Bot is a modular Linux botnet that turns internet-facing gateway devices into SOCKS5 traffic relay nodes while also harvesting credentials, brute–forcing SSH, and launching distributed denial-of-service (DDoS) attacks. The malware offers operators an interactive shell, file-transfer commands for uploads and downloads, and a SOCKS5 module that can operate in both direct listening and reverse-relay modes. Proxying sessions run independently and multiple sessions can be opened simultaneously, which Fortinet says enables attackers to conceal malicious traffic, bypass geographic restrictions, or potentially repurpose compromised hosts as monetizable residential proxy services.
How the malware spreads, installs, and persists
Active since at least July, Evooo1Bot targets devices by exploiting known vulnerabilities and, when exploitation succeeds, downloads one of 12 available builds that match the host’s CPU architecture. After installation, the malware clears Bash history to remove traces. Persistence is established through multiple mechanisms: systemd units, SysV init entries, edits to shell profiles and rc.local, and a cron job that attempts to re-download the payload every five minutes. Communications with command-and-control (C2) servers are encrypted and use TCP port 443, and the code performs extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots before activation.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageTechnical modules: credential sniffer, SSH scanner, SOCKS5 and DDoS
Fortinet’s analysis details several functional modules. The credential sniffer monitors /proc/net/tcp and attempts to capture HTTP Basic Authentication and Cookie headers. The SSH scanner cycles through a list of 150 username and password combinations aimed at enterprise-oriented accounts and performs post-login checks designed to avoid honeypots. The SOCKS5 module supports both listening and reverse-relay modes and can host multiple concurrent proxy sessions.
The DDoS capability is derived from Mirai’s public source but expanded within Evooo1Bot: it supports 16 flood methods, such as UDP, DNS, SYN, ACK, GRE, fragmented TCP, and an HTTP flood that allows customizable requests. Fortinet notes that some of the newer embedded exploits in the malware are incorrectly implemented, causing exploitation attempts to fail in those cases.
Targets, exploit arsenal, and observed vendors
Fortinet reports that Evooo1Bot has targeted devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link across multiple regions by leveraging known vulnerabilities. Newer builds include a separate exploitation module that attempts to attack Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress‑nginx, and vulnerable PHP‑CGI installations. Where exploits work, the matching payload is pulled and installed; where implementation errors exist, exploitation fails.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Expect a multi-stage threat that blends credential theft, brute force, and proxying. Defenders should be alert to encrypted C2 traffic on port 443 that follows successful exploitation and to persistence artifacts in systemd, SysV init, shell profiles, rc.local, and frequent cron download attempts.
- Procurement and device owners: The malware’s targeting of consumer and enterprise edge gear — including routers and NAS devices from specific vendors named above — underscores the need to replace unsupported devices and to prioritize firmware updates and configuration hygiene.
- End users and operators of exposed devices: Fortinet’s guidance is direct: keep device firmware updated, replace vendor default admin credentials, turn off remote access panels, and replace devices when the vendor no longer provides support. These measures matter because, as Fortinet highlights citing the Blue Report 2026, overall prevention scores can mask post-compromise realities — once valid credentials are in use, prevention effectiveness drops sharply.
Fortinet’s findings show Evooo1Bot as a capable, modular evolution of Mirai-style toolsets, combining familiar DDoS mechanics with new features aimed at persistence, credential capture, and traffic relay. Its mixture of working and mis-implemented exploits means some attacks will succeed and others will fail, but the breadth of targeted products — and the use of encrypted C2 over a common port — makes detection and mitigation more complex.
Original reporting: https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes/
