Researchers at Fortinet have identified a new Linux botnet called Evooo1Bot that has been compromising internet-facing gateway devices since at least July, converting them into SOCKS5 traffic relay nodes for attackers. The malware builds on the publicly leaked Mirai source code but adds a substantial set of new capabilities beyond the original DDoS-focused framework.

According to Fortinet, Evooo1Bot has been targeting devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link across multiple regions by exploiting known vulnerabilities. Newer builds include a dedicated exploitation module aimed at Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installations, though Fortinet notes some of the embedded exploits are not correctly implemented and fail during attempted exploitation.

When an exploit does succeed, a script fetches one of 12 architecture-specific malware builds and clears Bash history to erase traces of the intrusion. Evooo1Bot communicates with its command-and-control infrastructure over encrypted channels on port 443, and performs extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots before executing on an infected host.

Persistence and capabilities

The malware establishes persistence through systemd, SysV init, shell profiles, and rc.local, backed by a cron job that re-downloads the payload every five minutes. Operators get an interactive shell for direct control over compromised systems, along with file-transfer commands for uploads and downloads.

  • A credential sniffer module monitors ‘/proc/net/tcp’ to capture HTTP Basic Authentication and Cookie headers.
  • The SOCKS5 module supports both direct listening and reverse-relay modes, letting attackers hide malicious traffic, bypass geographic restrictions, or reach internal networks through compromised devices. Multiple proxy sessions can run simultaneously, opening the door to monetization via residential proxy services.
  • An SSH brute-force scanner uses 150 username and password combinations targeting enterprise-style accounts, with post-login checks designed to avoid honeypots.
  • The inherited Mirai DDoS module supports 16 flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and customizable HTTP floods.

To defend against this and similar botnet malware, organizations and users should keep IoT and gateway device firmware updated, replace default administrative credentials, disable remote access panels where not required, and retire devices that no longer receive vendor support.