New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.
Fortinet's FortiGuard Labs disclosed Evooo1Bot, a previously undocumented Linux botnet active since July 2026 that reuses Mirai's DDoS engine while adding encrypted C2, SSH brute-force scanning, credential sniffing, and SOCKS5 proxy modules. The bot exploits 18 known CVEs across Alcatel, NETGEAR, Tenda, D-Link, Telesquare, and Mitsubishi devices, some dating back to 2007, and communicates exclusively over port 443 to blend with HTTPS traffic. Compromised hosts can be turned into SOCKS5 relays for anonymous traffic forwarding or monetization via proxy services. The malware uses AES-256-CTR, ChaCha20, and XOR obfuscation with a 28-command administration interface.
- Exploits 18 known CVEs across routers, cameras, and edge devices, opportunistically targeting unpatched firmware
- SOCKS5 module supports direct listening mode and reverse relay mode for proxy infrastructure
- Intercepts HTTP Basic Auth credentials and cookies passing through infected devices
- Encrypted C2 over port 443 blends with normal HTTPS traffic
- CVEs
- CVE-2007-3010CVE-2016-6277CVE-2018-14558CVE-2019-14931CVE-2020-10987CVE-2021-46422CVE-2022-37055CVE-2024-29269CVE-2025-10123CVE-2025-55583
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2007-3010 | Command Injection RCE in Alcatel OmniPCX Enterprise masterCGI | — | 97% | KEV | — KEV |
| CVE-2016-6277 | Unauthenticated RCE via Command Injection in NETGEAR Multiple Routers | 8.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2018-14558 | Unauthenticated Command Injection in Tenda AC7, AC9, and AC10 Routers | 9.8 | 9% | KEVPoC | KEV |
| CVE-2019-14931 | An issue was discovered on Mitsubishi Electric Europe B.V | 9.8 | 57% | PoC | |
| CVE-2020-10987 | Unauthenticated OS Command Injection in Tenda AC15 AC1900 Router | 9.8 | 80% | KEVPoC | KEV |
| CVE-2021-46422 | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication | 9.8 | 94% | PoC ×2 | |
| CVE-2022-37055 | Unauthenticated Buffer Overflow in D-Link GO-RT-AC750 Router Firmware | 9.8 | 56% | KEVPoC | KEV |
| CVE-2024-29269 | An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter | 8.8 | 6% | PoC | |
| CVE-2025-10123 | D-Link DIR-823X up to 250416: Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the… | 5.5 | 4% | PoC ×2 | |
| CVE-2025-55583 | D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component | 9.8 | 7% | PoC |
From the original article
3 min read at securityaffairs.com
Evooo1Bot is a Mirai-based Linux botnet that hijacks routers and IoT devices for DDoS attacks, credential theft and criminal proxy services. Fortinet’s FortiGuard Labs disclosed Evooo1Bot in mid-August, a previously undocumented Linux botnet that’s been active since July 2026.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.