Cloudflare reports 18.2 million L3 DDoS attacks in Q3
That is about 8,226 network-layer attacks an hour, up from 13.2 million in Q2, plus 14.4 trillion HTTP DDoS requests.
52
Malware
Evooo1Bot
- Mentions · 7d3
- Mentions · 30d3
- All mentions7
- First seenAug 13, 2026
- Last mentioned9h ago
Timeline
7 articles · newest firstCloudflare mitigated 18.2 million DDoS attacks in Q3 2026
Attacks rose 208% year over year, but 98% stayed under 1 Gbps and most ended within ten minutes.
58
Cloudflare: short DDoS bursts rose 208% in Q3 2026
Attacks over 1 Tbps fell to 251 from 805 after takedowns of four large IoT botnets.
46
New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.
45
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
55
New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies
A newly observed Mirai-based Linux botnet dubbed Evooo1Bot compromises edge devices and turns them into persistent proxies for threat actors.
40
New Mirai variant adds stealth capabilities to notorious botnet code
FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.
60
Related CVEs
by mentions- CVE-2018-145589%9.8Unauthenticated Command Injection in Tenda AC7, AC9, and AC10 Routers
- CVE-2020-1098780%9.8Unauthenticated OS Command Injection in Tenda AC15 AC1900 Router
- CVE-2022-3705556%9.8Unauthenticated Buffer Overflow in D-Link GO-RT-AC750 Router Firmware
- CVE-2016-6277100%8.8Unauthenticated RCE via Command Injection in NETGEAR Multiple Routers
- CVE-2007-301097%—Command Injection RCE in Alcatel OmniPCX Enterprise masterCGI
- CVE-2019-1493157%9.8An issue was discovered on Mitsubishi Electric Europe B.V
- CVE-2021-4642294%9.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication
- CVE-2025-555837%9.8D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component
- CVE-2024-292696%8.8An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter
- CVE-2025-101234%5.5D-Link DIR-823X up to 250416: Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the…
Appears with
- Miraimalware · 6
- KimWolfmalware · 4
- Aisurumalware · 4
- Dysphoriamalware · 3
- Cloudflarevendor · 3
- Fortinetvendor · 3
- JackSkidmalware · 3
- Cloudforce Oneorganization · 3
- Mossadmalware · 3
- Tendavendor · 2
- Telesquarevendor · 2
- D-Linkvendor · 2
- Mitsubishi Electricvendor · 1
- Netgearvendor · 1
- Zyxelvendor · 1
- WSO2vendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.