Meta News

A new Linux botnet is expanding the familiar Mirai playbook beyond distributed denial-of-service attacks, turning compromised routers and internet-facing gateway devices into traffic relays that can conceal other malicious activity.

The malware, tracked as Evooo1Bot, has been active since at least July and is targeting devices from manufacturers including Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link. Researchers at Fortinet describe it as a modular evolution of Mirai that retains the notorious botnet’s DDoS capabilities while adding credential theft, vulnerability exploitation, SSH brute forcing and, most notably, a SOCKS5 proxy module.

That combination makes Evooo1Bot considerably more versatile than a conventional IoT botnet. Instead of using infected hardware exclusively as disposable nodes for overwhelming targets with traffic, its operators can transform routers into infrastructure through which other internet activity can be routed.

Mirai demonstrated nearly a decade ago how poorly secured routers, cameras and embedded Linux devices could be assembled into enormous botnets. Evooo1Bot builds on that foundation but reflects how the economics of compromised devices have evolved.

Its SOCKS5 functionality supports both direct listening and reverse-relay modes. Once activated, attackers can route connections through infected devices, making malicious traffic appear to originate from the victim’s IP address rather than infrastructure directly associated with the attacker. Multiple proxy sessions can operate independently and simultaneously on the same compromised system.

This gives the botnet potential uses extending well beyond DDoS. Compromised residential and business IP addresses can help attackers conceal their infrastructure, bypass geographic restrictions or make suspicious activity more difficult to distinguish from legitimate internet traffic. Fortinet researchers also note that a sufficiently large network could potentially be monetized as a residential proxy service.

The router therefore becomes valuable not simply for its computing power, but for its network identity. An ordinary IP address belonging to a home or business connection can be considerably less suspicious to fraud-detection systems than traffic originating from a known hosting provider or malicious server.

Evooo1Bot’s capabilities extend well beyond proxying. Fortinet found that the malware incorporates encrypted command-and-control communications, an interactive shell, file-transfer functionality, credential collection and a vulnerability exploitation framework.

The malware communicates with its command-and-control infrastructure over port 443 and attempts to detect whether it is running inside a debugger, sandbox, virtual machine, container or honeypot before fully executing. These checks are designed to make automated analysis more difficult and reduce the likelihood that the malware reveals its behavior inside environments operated by security researchers.

Once established, Evooo1Bot can create persistence through several Linux mechanisms, including systemd, SysV init, shell profiles andrc.local. A cron job attempts to download the malware again every five minutes, providing another mechanism for restoring the infection if components are removed.

The operators can also open an interactive shell on compromised devices and transfer files in either direction, turning infected networking hardware into a remotely accessible Linux system rather than simply a passive bot.

The campaign uses known vulnerabilities to compromise internet-facing equipment. Newer Evooo1Bot builds contain a separate exploitation module targeting a surprisingly broad collection of technologies, including Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS systems, WSO2 products, Kubernetes ingress-nginx and vulnerable PHP-CGI deployments.

Not every exploit included in the malware works correctly. Fortinet found implementation errors that cause some exploitation attempts to fail. But the breadth of the arsenal is significant because it shows the operators are attempting to create a general-purpose infection framework rather than focusing on a single vulnerable product.

When exploitation succeeds, the attackers execute a script that selects one of 12 Evooo1Bot builds according to the CPU architecture of the compromised device. The malware then clears Bash history in an attempt to remove evidence of the intrusion.

Supporting numerous architectures is essential for IoT malware because routers and embedded systems do not share the relatively standardized hardware environment found on desktop computers. The same botnet may encounter ARM, MIPS, x86 and other processor families across different manufacturers.

Vulnerability exploitation is not Evooo1Bot’s only mechanism for finding additional victims. The malware includes an SSH scanner equipped with approximately 150 username and password combinations, with particular attention given to enterprise-oriented accounts.

After successfully authenticating, the malware performs additional checks intended to determine whether the target might be a honeypot before proceeding.

This continues one of the most persistent weaknesses exploited by IoT botnets: weak credentials on remotely accessible management services. A fully patched device can still become vulnerable if administrative interfaces remain exposed to the internet with predictable or reused passwords.

The combination of exploit scanning and credential attacks gives Evooo1Bot two complementary paths into new systems. Vulnerable software provides one route; poor identity security provides another.

The botnet also contains a credential-sniffing module that monitors Linux network connection information through/proc/net/tcpand attempts to capture HTTP Basic Authentication credentials and Cookie headers.

This capability potentially allows the compromise to extend beyond the router itself. Credentials observed passing through or available to an infected device may provide attackers with additional opportunities to access applications and infrastructure.

It also reinforces why compromised gateway devices are particularly dangerous. Routers occupy a privileged position in network architecture because traffic from other systems naturally passes through them. Once the gateway itself becomes hostile, defenders must consider not only what attackers can do with the device, but what the device can observe about the surrounding network.

Despite its expanded capabilities, Evooo1Bot has not abandoned Mirai’s original purpose. Its DDoS module incorporates the engine from the publicly leaked Mirai source code and supports 16 different flooding methods.

Those include UDP, DNS, SYN, ACK and GRE floods, fragmented TCP attacks and customizable HTTP flooding.

The modular design means operators do not have to choose between operating a proxy network and maintaining a DDoS botnet. The same population of infected devices can potentially support several criminal services depending on what the operators require.

That flexibility is one of the more important developments represented by Evooo1Bot. Compromised IoT devices are becoming general-purpose infrastructure rather than machines recruited for a single attack.

Routers and other gateway devices provide attackers with several advantages. They are continuously connected to the internet, often remain powered on for months without interruption and frequently receive less security attention than laptops or servers.

Many consumer and small-business devices also remain deployed long after manufacturers stop providing firmware updates. Users may replace computers and smartphones every few years while leaving the same router operating indefinitely.

Because these devices sit at the edge of networks, they can also provide attackers with IP addresses that carry an established residential or business reputation. That makes them particularly attractive as proxy nodes.

Evooo1Bot exploits precisely these characteristics. The malware does not need a powerful computer to create value. A modest router with a reliable broadband connection can become useful criminal infrastructure simply by forwarding someone else’s traffic.

The evolution from DDoS-focused botnets toward proxy networks also creates a more complicated problem for defenders.

A DDoS attack produces obvious symptoms. Enormous amounts of traffic suddenly target a service, making the malicious behavior relatively easy to recognize even if stopping it remains difficult.

Proxy abuse can be far quieter.

An infected router may continue functioning normally for its owner while simultaneously relaying external traffic in the background. The victim might notice little beyond unexplained bandwidth consumption or performance degradation.

Meanwhile, investigators examining malicious activity may initially trace it back to the compromised router rather than the actual attacker. This effectively transfers part of the attacker’s attribution risk to an innocent third party.

The compromised device becomes both infrastructure and camouflage.

Evooo1Bot reinforces a broader shift in cyber risk. Organizations have invested heavily in protecting laptops, servers and cloud workloads, but internet-facing networking equipment remains an attractive entry point precisely because it is often managed differently.

Defending against campaigns like Evooo1Bot requires relatively familiar controls: keeping firmware updated, replacing default administrative credentials, disabling unnecessary remote-management interfaces and retiring hardware that no longer receives vendor security updates.

Those measures may sound basic, but botnets continue to thrive because enormous numbers of devices remain exposed without them.

Evooo1Bot’s significance is therefore not that it has reinvented Mirai. It has adapted Mirai to a more mature underground economy. A compromised router is no longer valuable only because it can generate attack traffic. It can provide credentials, remote access, DDoS capacity and, increasingly, something attackers find extremely useful:a legitimate-looking IP address through which almost any other malicious activity can be hidden.