Evooo1Bot Linux Botnet Hijacks Edge Devices with 16 DDoS Methods and SOCKS5 Proxies
A new Linux botnet, Evooo1Bot, is compromising internet-facing edge devices by exploiting known vulnerabilities and weak SSH credentials, turning them into tools for DDoS attacks, proxy services, and credential theft.
A newly identified Linux botnet, dubbed Evooo1Bot, is actively compromising internet-facing edge devices by exploiting known vulnerabilities and attempting weak SSH logins. Once a device is compromised, its operators can issue commands through an encrypted control channel. This campaign is notable for its multifaceted approach, combining code from the leaked Mirai framework with advanced proxy, credential-sniffing, file-transfer, and exploit functionalities. This blend allows attackers to leverage a single compromised device for various malicious purposes, mirroring recent trends in Mirai botnet abuse.
Fortinet analysts first detected Evooo1Bot after observing widespread exploitation attempts targeting a variety of edge devices. Telemetry data indicated that the botnet began its campaign in July 2026, with different attack vectors being tracked based on the specific vulnerabilities exploited. The immediate threat extends beyond simple denial-of-service attacks; infected systems can be enlisted to attack other targets, mask an operator's true origin, or serve as a pivot point for gaining access to internal network resources. This underscores the critical importance of securing edge devices that are left exposed and unpatched.
Evooo1Bot is equipped with 16 distinct methods for launching distributed denial-of-service (DDoS) attacks, including UDP, DNS, SYN, GRE, and fragmented TCP attacks. While its core engine shares structural similarities with the leaked Mirai code, its HTTP flood function offers greater flexibility. Attackers can customize request methods, headers, and expected response values, making the malicious traffic more difficult to detect and block. Furthermore, the botnet includes an exploit dispatcher capable of delivering payloads by exploiting known vulnerabilities in devices from manufacturers such as D-Link, Tenda, Hikvision, Zyxel, and TP-Link, among others.
Following a successful compromise, a loader script retrieves a processor-architecture-matched binary, executes it temporarily, and then attempts to erase traces by clearing the Bash history. Evooo1Bot employs multiple persistence mechanisms, including system services, startup scripts, scheduled tasks, shell profiles, and modifications to rc.local. Before establishing a connection to its command and control (C2) server on port 443, the malware performs checks to detect analysis tools, sandboxes, virtual machines, and containers, aiming to evade detection.
The SOCKS relay module significantly enhances Evooo1Bot's utility beyond DDoS operations. In its direct mode, the bot can establish a SOCKS5 listener, typically on TCP port 1080. In reverse mode, it creates encrypted outbound connections to an operator-specified relay server, enabling traffic to traverse the victim's network without exposing a listener to the internet. This capability is crucial for concealing the origin of malicious activities, bypassing geographical restrictions, and providing a pathway into networks protected by a compromised edge device.
Adding to its arsenal, Evooo1Bot features an SSH scanner that attempts to log in using over 150 embedded credentials, including common service account names found in enterprise environments. To evade detection, it analyzes SSH banners and probes successful targets for signs of emulation. A dedicated sniffer module can capture HTTP Basic Authorization and Cookie headers, increasing the potential for credential theft and further compromising targeted systems.
Organizations are advised to take proactive measures to mitigate the risks posed by Evooo1Bot. This includes maintaining an up-to-date inventory of all internet-exposed equipment, promptly applying vendor-released firmware updates, disabling remote management interfaces where they are not essential, and diligently monitoring for unusual outbound network connections. Network teams should also investigate any new SOCKS listeners, unexpected scheduled downloads, or systems initiating connections to known malicious infrastructure.
The threat posed by Evooo1Bot highlights the persistent danger of unsecured edge devices. By implementing basic security hygiene, such as strong, unique administrative credentials, prompt patching, and vigilant network monitoring, organizations can significantly reduce their attack surface and prevent their devices from being co-opted into botnets.