New Evooo1Bot Linux Botnet Turns Internet Facing Devices Into SOCKS Proxies
Cybersecurity researchers have identified a previously undocumented Linux botnet called Evooo1Bot that is based on the leaked Mirai source code and can compromise internet facing devices to create SOCKS5 proxy nodes.
Fortinet FortiGuard Labs reported that Evooo1Bot combines Mirai's DDoS capabilities with several additional features, including encrypted command and control communications, SSH brute force scanning, credential interception, proxy functionality, and an integrated exploit module.
Active Since July 2026
Researchers believe Evooo1Bot has been active in the wild since July 2026. The botnet targets publicly accessible devices by exploiting known vulnerabilities.
Observed vulnerabilities include:
- CVE-2007-3010: Alcatel OmniPCX Enterprise remote code execution
- CVE-2016-6277: NETGEAR router remote code execution
- CVE-2018-14558: Tenda router command injection
- CVE-2019-14931: Mitsubishi Electric ME-RTU command injection
- CVE-2020-10987: Tenda AC15 remote code execution
- CVE-2021-46422: Telesquare SDT-CW3B1 command injection
- CVE-2022-37055: D-Link router buffer overflow
- CVE-2024-29269: Telesquare TLR-2005KSH command injection
- CVE-2025-10123: D-Link DIR-823X command injection
- CVE-2025-55583: D-Link DIR-868L B1 command injection
How Evooo1Bot Infects Devices
After successfully exploiting a vulnerable device, the attackers execute a loader script that downloads the appropriate Evooo1Bot binary for the device's CPU architecture.
The malware also attempts to remove traces of the infection by clearing Bash history.
Once executed, Evooo1Bot checks for security analysis tools, sandboxes, and virtual environments. It then establishes encrypted communication with its command and control server over TCP port 443, helping its traffic blend with normal HTTPS activity.
Extensive Botnet Capabilities
After registering with its C2 infrastructure, Evooo1Bot can receive commands to:
- Establish persistence
- Update or terminate the malware
- Upload and download files
- Launch an interactive shell
- Capture HTTP Basic Authorization credentials and cookies
- Turn compromised devices into SOCKS5 proxy servers
- Conduct SSH brute force attacks
- Launch DNS, TCP, and UDP DDoS attacks
- Exploit additional vulnerable systems
The botnet's exploit module includes vulnerabilities affecting products from Hikvision, Atlassian, WSO2, Zyxel, TP Link, PHP, D-Link, and Kubernetes.
Compromised Devices Become Proxy Nodes
One of Evooo1Bot's most notable capabilities is its SOCKS5 proxy functionality.
A compromised router, firewall, IP camera, or other edge device can be converted into a network relay controlled by the attacker.
This allows threat actors to route malicious traffic through the victim's IP address, making their activity harder to trace. Attackers could also use compromised systems to bypass geographic restrictions, reach internal networks, or build large distributed proxy networks.
Security Impact
Evooo1Bot demonstrates how attackers continue to repurpose publicly available malware code such as Mirai while adding new capabilities for modern attacks.
Organizations should ensure internet facing devices are fully patched, disable unnecessary remote services, restrict administrative access, monitor unusual outbound connections, and investigate unexpected proxy or SSH activity from network devices.
