New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.
Fortinet's FortiGuard Labs disclosed Evooo1Bot, a previously undocumented Linux botnet active since July 2026 that reuses Mirai's DDoS engine while adding encrypted C2, SSH brute-force scanning, credential sniffing, and SOCKS5 proxy modules. The bot exploits 18 known CVEs across Alcatel, NETGEAR, Tenda, D-Link, Telesquare, and Mitsubishi devices, some dating back to 2007, and communicates exclusively over port 443 to blend with HTTPS traffic. Compromised hosts can be turned into SOCKS5 relays for anonymous traffic forwarding or monetization via proxy services. The malware uses AES-256-CTR, ChaCha20, and XOR obfuscation with a 28-command administration interface.
- Exploits 18 known CVEs across routers, cameras, and edge devices, opportunistically targeting unpatched firmware
- SOCKS5 module supports direct listening mode and reverse relay mode for proxy infrastructure
- Intercepts HTTP Basic Auth credentials and cookies passing through infected devices
- Encrypted C2 over port 443 blends with normal HTTPS traffic
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2007-3010 | Command Injection RCE in Alcatel OmniPCX Enterprise masterCGI CVE-2007-3010 is a command execution flaw in masterCGI, a component of the Unified Maintenance Tool in the Alcatel OmniPCX Enterprise Communication Server. Because the CGI fails to properly validate user-supplied input (CWE-20), a remote attacker can send crafted requests to the web-based maintenance interface and inject arbitrary operating system commands, which are executed on the PBX server. Successful exploitation yields remote code execution on the communication server, giving attackers a foothold on a Linux-based edge device that could be used for further compromise, lateral movement into the voice network, or, per recent botnet trends, conscription into proxy botnets. Any organization running an Alcatel OmniPCX Enterprise communication server with the Unified Maintenance Tool reachable is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-15) with a very high 97.4% EPSS score, indicating active in-the-wild exploitation, though no public proof-of-concept code is known. Do: Apply updates per vendor instructions (Alcatel/Aastra/Alcatel-Lucent Enterprise maintenance releases) as required by CISA's KEV catalog. Until patched, restrict access to the Unified Maintenance Tool web interface (masterCGI) to trusted management networks only, e.g., via firewall or ACL rules, and avoid exposing it to the internet. Given recent Mirai-based botnets targeting Linux edge devices, audit OmniPCX servers for signs of compromise such as unexpected processes or outbound proxy (SOCKS5) traffic. | — | 97% | KEV |
| moderateroughly 1,000–10,000 internet-exposed systems (estimate; enterprise PBX deployments with only a fraction exposing the management interface) | |
| CVE-2016-6277 | Unauthenticated RCE via Command Injection in NETGEAR Multiple Routers Multiple NETGEAR router models allow unauthenticated web pages to pass form input directly to the device's command-line interface, which permits remote code execution (CVE-2016-6277). An attacker triggers the flaw by sending a crafted HTTP request to the router's web interface without logging in, causing attacker-supplied input to be interpreted as commands on the router. Successful exploitation grants the ability to run arbitrary commands on the device, typically with root privileges, enabling full takeover of the router and use as a pivot point into the network behind it. Any NETGEAR router among the affected models running firmware without the vendor patch is vulnerable, with internet-facing management interfaces at greatest risk. The flaw was added to CISA's Known Exploited Vulnerability catalog on 2022-03-07, indicating exploitation in the wild, and it carries a very high 99.8% EPSS probability of exploitation within 30 days. Do: Update affected NETGEAR routers to the latest available firmware for the specific model, per the vendor's upgrade instructions, as required by CISA's KEV listing. As interim mitigation, disable WAN-side/remote management and restrict the router's admin interface to the local network, then review devices for signs of compromise such as unexpected configuration changes or added accounts. | 8.8 | 100% | KEV PoC ×3 |
| masslikely 100,000+ internet-exposed NETGEAR routers (exact count unknown) | |
| CVE-2018-14558 | Unauthenticated Command Injection in Tenda AC7, AC9, and AC10 Routers CVE-2018-14558 is an unauthenticated OS command injection flaw (CWE-78) in the web interface of Tenda AC7, AC9, and AC10 routers, where the formsetUsbUnload handler passes untrusted input to the dosystemCmd function. An attacker triggers it by sending a crafted HTTP request to the goform/setUsbUnload endpoint, requiring no authentication or user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields arbitrary command execution on the router, enabling full device takeover for traffic interception, botnet enrollment, or pivoting into the local network. Anyone running AC7 firmware through V15.03.06.44_CN(AC7), AC9 firmware through V15.03.05.19(6318)_CN(AC9), or AC10 firmware through V15.03.06.23_CN(AC10) is affected. The flaw has a public proof of concept, an 8.7% EPSS (95th percentile), and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, indicating exploitation in the wild. Do: Apply updated firmware from Tenda per vendor/CISA instructions, upgrading AC7 beyond V15.03.06.44_CN, AC9 beyond V15.03.05.19(6318)_CN, and AC10 beyond V15.03.06.23_CN. Until patched, avoid exposing the router's web management interface to the internet (disable remote/WAN management) and restrict admin access to trusted clients. Check device logs for unsolicited requests to goform/setUsbUnload as an indicator of exploitation. | 9.8 | 9% | KEV PoC |
| massplausibly 1M+ affected devices (estimate; hundreds of thousands of Tenda web interfaces appear internet-exposed in public scans) | |
| CVE-2019-14931 | An issue was discovered on Mitsubishi Electric Europe B.V. An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data. NVD description · AI analysis pending | 9.8 | 58% | PoC |
| — | |
| CVE-2020-10987 | Unauthenticated OS Command Injection in Tenda AC15 AC1900 Router CVE-2020-10987 is an unauthenticated OS command injection flaw (CWE-78) in the goform/setUsbUnload endpoint of the Tenda AC15 AC1900 router, demonstrated on firmware version 15.03.05.19. An attacker triggers it by sending a crafted deviceName POST parameter to that endpoint, which is not properly sanitized before being used in a system command. Successful exploitation yields arbitrary remote code execution on the router, giving the attacker full control of the device and a foothold to pivot into the local network, as is typical for IoT botnet recruitment. Owners of Tenda AC15 routers are affected, with greatest risk on units whose web administration interface is reachable from the internet. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), carries a 79.8% EPSS score (top percentile), and a public proof of concept has been available since its 2020 disclosure; ransomware use is unknown. Do: Apply the latest Tenda AC15 firmware available from the vendor (newer than 15.03.05.19) per CISA's required action and vendor instructions. Until patched, disable or restrict WAN-side remote web administration to trusted source IPs, since the flaw is exploitable without credentials over the network. Check router HTTP logs for unexpected POST requests to /goform/setUsbUnload containing suspicious deviceName values, and monitor for botnet-style command activity. | 9.8 | 80% | KEV PoC |
| moderateLikely on the order of thousands to tens of thousands of remotely exploitable Tenda AC15 units (estimate; no authoritative install-base or scan count provided). | |
| CVE-2021-46422 | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication. Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication. NVD description · AI analysis pending | 9.8 | 94% | PoC ×2 |
| — | |
| CVE-2022-37055 | Unauthenticated Buffer Overflow in D-Link GO-RT-AC750 Router Firmware CVE-2022-37055 is a buffer overflow (CWE-120) in the cgibin binary's hnap_main handler on D-Link GO-RT-AC750 routers running GORTAC750_revA_v101b03 or GO-RT-AC750_revB_FWv200b02 firmware. Because the flaw sits in the router's HNAP/web management interface and requires no authentication, a remote attacker can trigger it with crafted network requests sent directly to the device. Successful exploitation can corrupt memory and is scored critical (CVSS 3.1: 9.8), giving the attacker potential full control of the router with high confidentiality, integrity, and availability impact. Owners of these specific GO-RT-AC750 (rev A and rev B) firmware releases are affected, and the broader context of active Mirai-family botnet campaigns targeting Linux-based edge devices raises the risk of automated mass exploitation. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2025-12-08, confirming exploitation in the wild, and its EPSS of 55.5% (99th percentile) indicates a high near-term probability of exploitation. Do: Check GO-RT-AC750 (rev A and rev B) devices for the listed firmware versions and apply D-Link's mitigations or updated firmware per vendor instructions; if no fixed firmware is available, discontinue use of the device. Reduce exposure immediately by disabling HNAP, blocking remote management, or restricting the router's web interface to trusted networks, since exploitation requires no credentials. Federal agencies should follow BOD 22-01 timelines for remediation. | 9.8 | 56% | KEV PoC |
| largelikely tens of thousands of internet-exposed units (public scans repeatedly find large populations of HNAP-enabled D-Link consumer routers; exact counts for… | |
| CVE-2024-29269 | An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter. An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter. NVD description · AI analysis pending | 8.8 | 6% | PoC |
| — | |
| CVE-2025-10123 | A vulnerability was determined in D-Link DIR-823X up to 250416. A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. NVD description · AI analysis pending | 5.5 | 5% | PoC ×2 |
| — | |
| CVE-2025-55583 | D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests. NVD description · AI analysis pending | 9.8 | 7% | PoC |
| — |
Full article747 words · extracted from securityaffairs.com · click to collapse
Evooo1Bot is a Mirai-based Linux botnet that hijacks routers and IoT devices for DDoS attacks, credential theft and criminal proxy services.
Fortinet’s FortiGuard Labs disclosed Evooo1Bot in mid-August, a previously undocumented Linux botnet that’s been active since July 2026. The bot borrows Mirai‘s DDoS engine but adds encrypted command-and-control communications, an SSH brute-force scanner, a credential sniffer, and a SOCKS5 proxy module on top.
“FortiGuard Labs has been tracking a previously undocumented Linux botnet family, which we have named Evooo1Bot. The name derives from the hardcoded string “evooo1” found in every binary.” reads the report published by Fortinet. “While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities.”
The botnet targets 18 known CVEs, some of them dating back to 2007, including:
- CVE-2007-3010: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
- CVE-2016-6277: NETGEAR Multiple Routers Remote Code Execution Vulnerability
- CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
- CVE-2019-14931: Mitsubishi Electric Europe B.V. ME-RTU devices and INEA ME-RTU devices remote Command Injection vulnerability
- CVE-2020-10987: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
- CVE-2021-46422: Telesquare SDT-CW3B1 Command Injection vulnerability
- CVE-2022-37055: D-Link Routers Buffer Overflow Vulnerability
- CVE-2024-29269, Telesquare TLR-2005KSH Command Injection Vulnerability
- CVE-2025-10123, D-Link DIR-823X Command Injection Vulnerability
- CVE-2025-55583: D-Link DIR-868L B1 router Command Injection Vulnerability
The bot communicates exclusively over port 443, which is intentional: the traffic blends into expected HTTPS flows at the network perimeter. After gaining initial access through one of its exploit modules or via brute-forced SSH credentials, the bot runs a loader script that clears Bash history to erase evidence of the intrusion before pulling the architecture-appropriate binary from an external server.
The breadth suggests the operators are scanning opportunistically for anything unpatched rather than targeting specific organizations.
“This capability significantly increases the value of an infected host to attackers. The victim’s IP address can be used to disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine.” continues the report. “In larger botnets, the same functionality could also be used to build a distributed proxy infrastructure, enabling anonymous traffic forwarding or monetization through residential and enterprise proxy services.”
Evooo1Bot stands out because of its proxy module. A network of compromised routers, cameras, and firewalls acting as SOCKS5 relays is a valuable commodity; operators can use it themselves to obscure attack traffic, or sell access to other criminals looking for residential or enterprise IP addresses that don’t trigger geographic blocks.
“Unlike typical botnet commands that focus on downloading payloads or launching attacks, the !socks module turns an infected host into a SOCKS5 proxy that the operator can use as a network relay. It supports two operating modes. In direct mode, it opens a SOCKS5 listener on the infected host on the default TCP port 1080 and waits for incoming client connections. The implementation first attempts to create a dual-stack IPv6 listener and falls back to IPv4 if that fails. Each accepted client is then passed to the session handler for proxying.” continues the report. “The botnet also implements a reverse relay mode. Instead of exposing a listening port, the bot establishes an outbound encrypted connection to an operator-specified relay server. This persistent control channel listens for commands such as RELAY_NEW:<session_id>, which indicate that a new proxy session should be created.”
After establishing C2 contact, the bot accepts commands covering the full post-compromise toolkit: file upload and download, interactive shell access, persistence installation, binary updates, HTTP Basic Auth and Cookie header interception, DDoS over DNS, TCP, and UDP, and the HTTP exploit dispatcher.
The credential sniffer intercepts authentication headers in transit, so any HTTP Basic Auth credentials passing through an infected device can be captured without any additional effort from the operator. If you’re still running devices with unpatched firmware from the CVE list above, or if any of your edge hardware is using default SSH credentials, Evooo1Bot is already scanning for you.
“Beyond traditional botnet functionality, it features encrypted C2 communications, multiple layers of string obfuscation using AES-256-CTR, ChaCha20, and XOR-based key derivation, as well as a 28-command remote administration interface.” concludes the report. “These capabilities place Evooo1Bot well beyond the technical baseline of conventional Mirai-derived malware.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Evooo1Bot botnet)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/197434/malware/new-mirai-based-evooo1bot-botnet-targets-linux-devices.html