Listen to this Post
Introduction: The Ghost of Mirai Has Learned New Tricks
The Mirai botnet never truly disappeared. Nearly a decade after its source code was leaked to the public, its DNA continues to live inside new generations of Linux malware that target routers, cameras, network appliances, and other internet-facing devices.
Now, security researchers have uncovered a new and considerably more capable Mirai-derived botnet called Evooo1Bot. According to an August 13 analysis from FortiGuard Labs researcher Yi Ping (Cara) Lin, the malware has been actively targeting vulnerable edge devices since at least July 2026.
What makes Evooo1Bot particularly concerning is not simply the number of vulnerabilities it can exploit. Its developers appear to have taken the basic Mirai formula and transformed it into something much more operationally useful: an encrypted command-and-control system, a large remote administration interface, credential theft capabilities, an SSH scanner, and—most importantly—a SOCKS relay capable of turning compromised infrastructure into a proxy for future attacks.
This is an important evolution in the long-running Mirai ecosystem. Traditional Mirai-style malware was primarily associated with building enormous DDoS armies. Evooo1Bot suggests that some modern operators are interested in something more persistent: using compromised edge devices as hidden infrastructure for broader cyber operations.
The Discovery of Evooo1Bot
FortiGuard Labs researcher Yi Ping (Cara) Lin identified the malware after investigating exploitation attempts against a collection of internet-facing devices.
The family was named Evooo1Bot because the hardcoded string evooo1 appears throughout the analyzed binaries.
The campaign is particularly notable because the attackers are not concentrating on a single manufacturer or vulnerability class. Instead, they are combining vulnerabilities affecting routers, telecommunications equipment, industrial-related devices, and other network-connected systems.
That strategy dramatically increases the potential attack surface.
A Long List of Vulnerabilities
The exploitation activity observed by FortiGuard Labs includes several older vulnerabilities alongside much newer flaws.
Among the vulnerabilities associated with the campaign are CVE-2007-3010, affecting Alcatel OmniPCX Enterprise; CVE-2016-6277, affecting multiple NETGEAR routers; and CVE-2018-14558, involving command injection in Tenda AC7, AC9, and AC10 routers.
The campaign also includes CVE-2019-14931, associated with Mitsubishi Electric Europe and INEA ME-RTU devices, as well as CVE-2020-10987, affecting the Tenda AC15 AC1900 router.
More recent vulnerabilities appear in the attack chain as well, including CVE-2021-46422 affecting Telesquare SDT-CW3B1 devices, CVE-2022-37055 involving D-Link routers, and CVE-2024-29269, affecting Telesquare TLR-2005KSH devices.
The list continues into 2025 with CVE-2025-10123, a D-Link DIR-823X command-injection vulnerability, and CVE-2025-55583, affecting the D-Link DIR-868L B1.
NVD confirms that CVE-2025-10123 involves remotely exploitable command injection in affected DIR-823X firmware, while CVE-2025-55583 permits unauthenticated command execution against vulnerable DIR-868L B1 firmware.
Old Vulnerabilities Are Still Extremely Valuable
One of the most important lessons from this campaign is that attackers do not necessarily need a zero-day.
Some of the vulnerabilities being exploited are many years old. Yet they remain useful because internet-facing devices frequently have unusually long lifespans, inconsistent patching cycles, outdated firmware, and limited monitoring.
A vulnerability from 2007 can therefore remain operationally relevant in 2026 if the vulnerable appliance is still exposed to the internet.
This is exactly why edge-device security is so difficult. An organization may have modern endpoint detection on employee laptops and servers while an outdated router or specialized appliance quietly provides an attacker with a completely different entrance.
The Loader Infrastructure
According to the original investigation, exploitation attempts associated with Evooo1Bot ultimately pointed toward a common loader location hosted at 91.92.40[.]118/wget.sh.
Independent malware-tracking data also records that address as a malware-delivery URL. URLhaus reported the URL as serving malware and identified the retrieved shell script with a Gafgyt-related classification.
This is significant because it provides another piece of evidence connecting the observed exploitation activity to a broader Linux botnet ecosystem.
The infrastructure also illustrates how rapidly malicious hosting can become operational. A single shell script can act as the bridge between initial exploitation and deployment of architecture-specific malware.
Mirai’s DNA Is Still Everywhere
At its core, Evooo1Bot remains a member of the Mirai family tree.
The malware reuses
Mirai became infamous for compromising internet-connected devices and organizing them into massive botnets capable of launching DDoS attacks. Its source code was publicly leaked in September 2016, helping create an enormous ecosystem of descendants and modified variants.
Nearly ten years later, the underlying architecture remains attractive to criminals because it provides a proven foundation for discovering devices, infecting them, communicating with them, and coordinating large-scale operations.
But Evooo1Bot Goes Beyond Traditional Mirai
The major difference is what attackers can do after infection.
Traditional Mirai derivatives often focus heavily on scanning and DDoS functionality. Evooo1Bot reportedly incorporates a much broader collection of capabilities.
Researchers observed encrypted C2 communications, a 28-command remote administration interface, SSH brute-force scanning, a reverse SOCKS relay, credential-sniffing functionality, and extensive string obfuscation.
The malware reportedly uses multiple cryptographic and obfuscation mechanisms, including AES-256-CTR, ChaCha20, and XOR-based key derivation.
That combination indicates a deliberate attempt to make analysis and detection more difficult.
The SOCKS Relay May Be the Most Dangerous Feature
Among all of these capabilities, the reverse SOCKS relay deserves particular attention.
A compromised router is already valuable to an attacker because it sits at the edge of a network. But turning that device into a proxy can make it substantially more useful.
A SOCKS relay allows an attacker to route network activity through the compromised system. In practical terms, the victim’s device becomes a stepping stone between the attacker and another destination.
This can complicate attribution.
It can also potentially enable attackers to interact with internal services that would not otherwise be directly accessible from the public internet, depending on the compromised device’s network position and routing configuration.
FortiGuard Labs characterized this component as particularly operationally significant because it can transform an edge device into persistent proxy infrastructure.
From Botnet to Operational Infrastructure
This distinction matters.
A conventional DDoS botnet primarily wants volume. The more infected devices it controls, the more traffic it can generate.
A proxy-oriented botnet wants position.
One compromised router inside the right organization may be more valuable than hundreds of random consumer devices because it could provide access to a network segment, trusted communications path, or geographical location useful to the attacker.
That makes Evooo1Bot representative of a broader evolution in malware economics.
Compromised devices are no longer merely disposable DDoS soldiers. They can become infrastructure.
Why Edge Devices Remain a Prime Target
Routers and other edge appliances occupy a unique position in enterprise networks.
They are exposed by design.
They frequently run specialized operating systems.
They may not support conventional endpoint security agents.
They are sometimes forgotten after deployment.
And organizations often replace them much less frequently than laptops and servers.
This creates an uncomfortable security paradox: the device that controls network connectivity can sometimes receive less security attention than the computers connected behind it.
The D-Link Connection Is Especially Interesting
Several D-Link vulnerabilities appear in the reported exploitation activity.
CVE-2025-55583 is particularly serious because NVD records it as an unauthenticated OS command-injection vulnerability affecting the DIR-868L B1 under specific firmware conditions. CISA’s vulnerability enrichment gives it a CVSS 3.1 score of 9.8 and describes the exploitation as automatable with total technical impact.
D-Link’s own advisory also documents the command-injection issue affecting the relevant firmware and describes the vulnerable fileaccess.cgi component.
The DIR-823X issue, CVE-2025-10123, is similarly noteworthy because NVD records remote command injection affecting firmware versions up to the identified vulnerable release.
The Real Problem Is the Combination
Looking at these vulnerabilities individually can be misleading.
A router vulnerability might seem like one more entry in a huge vulnerability database.
A Mirai-derived malware sample might seem like another botnet variant.
A SOCKS proxy might seem like another malware feature.
But when these elements are combined, the risk becomes much greater.
Evooo1Bot appears to connect vulnerability exploitation, automated deployment, persistence, command-and-control, credential collection, network scanning, and proxying into a single operational framework.
That is far more concerning than a basic DDoS implant.
Deep Analysis: How Defenders Should Investigate Evooo1Bot
Start With Network Visibility
Security teams should begin by examining outbound connections from routers, gateways, and Linux-based appliances.
Unexpected outbound HTTP traffic from a device whose normal role is routing should immediately attract attention.
Defenders can search network telemetry for suspicious shell-script downloads, unexpected external IP addresses, and connections that do not correspond to normal vendor services.
Check for Unexpected Download Utilities
Malware loaders commonly abuse legitimate utilities such as wget and curl.
On Linux systems where administrators have shell access, defenders can review process execution data with:
ps aux --sort=-%cpu | head -30
The goal is not to identify a particular process by name, but to look for unexpected shell activity, download commands, scripts, or processes executing from unusual directories.
Review Active Network Connections
Administrators can inspect active connections with:
ss -tulpn
For broader connection visibility:
ss -antp
Unexpected outbound connections from routers or appliances should be investigated against the device’s intended function.
Search for Suspicious Scripts
On Linux systems where it is safe and appropriate to perform filesystem inspection:
find /tmp /var/tmp /dev/shm -type f -mtime -14 -ls
Temporary directories are commonly abused because malware authors often want to avoid leaving obvious files in standard application locations.
Examine Scheduled Persistence
Defenders should review cron configuration and other startup mechanisms:
crontab -l
For system-wide cron configuration:
grep -R "wget|curl|sh " /etc/cron 2>/dev/null
These commands are intended for defensive inspection, not exploitation.
Check Running Services
Another useful investigation step is:
systemctl --type=service --state=running
On embedded devices that do not use systemd, administrators should use the platform’s native service-management tools.
Inspect Authentication Activity
Because the malware reportedly includes SSH brute-force functionality and credential-related capabilities, authentication logs deserve special attention.
For systems using standard Linux authentication logs:
grep -Ei "failed|invalid|authentication failure" /var/log/auth.log 2>/dev/null | tail -100
The exact log location varies by distribution.
Hunt for Unexpected Proxy Behavior
Network defenders should also investigate devices behaving like intermediary proxies.
A router that suddenly establishes persistent outbound connections or creates unusual TCP sessions may be acting as a relay.
Network-flow analysis can be particularly valuable because proxy traffic may not look like conventional malware traffic at the application layer.
Preserve Evidence Before Reimaging
If an infected device is identified, immediately wiping it may destroy useful forensic evidence.
Where operationally possible, collect logs, process information, network connections, configuration data, and relevant filesystem artifacts before rebuilding the system.
For critical infrastructure, incident-response procedures should take precedence over ad-hoc cleanup.
Indicators Should Be Treated Carefully
The IP address associated with the loader should be considered a useful investigation indicator, not a permanent signature.
Attackers can move infrastructure quickly.
Domains and IP addresses can disappear.
New loaders can be deployed.
Compromised infrastructure can be repurposed.
Consequently, defenders should use indicators such as 91.92.40[.]118 alongside behavioral detection rather than relying exclusively on IP blocking. Independent malware-tracking telemetry confirms that the associated URL has been observed distributing malware.
Why Encryption Changes the Detection Equation
Encrypted C2 communications make traditional content inspection considerably less useful.
Security teams may not be able to read the commands being exchanged between an infected device and its operator.
Instead, detection has to move toward behavior.
Connection frequency.
Destination reputation.
Unusual persistence.
Unexpected traffic volume.
Abnormal DNS activity.
Unexpected process creation.
Unexpected outbound connections.
These signals can remain useful even when the malware’s payload is encrypted.
Obfuscation Is Another Layer of Defense for the Attacker
AES-256-CTR, ChaCha20, XOR-based transformations, and other obfuscation techniques can make static analysis more difficult.
But obfuscation is not invisibility.
Malware still has to execute.
It still needs network connectivity.
It still needs to interact with the operating system.
It still needs to load libraries and create processes.
That means behavioral telemetry remains one of the strongest ways to detect sophisticated malware on constrained systems.
The Exploit Mix Reveals an Important Attacker Strategy
The combination of vulnerabilities across different years is particularly revealing.
Attackers appear willing to maintain an exploit arsenal spanning nearly two decades.
That is rational from an operational perspective.
If an old vulnerability still compromises devices, there is little incentive to discard it simply because a newer vulnerability exists.
Cybercriminals do not care whether a vulnerability is fashionable.
They care whether it works.
Vulnerability Age Does Not Equal Risk Age
This is one of the biggest lessons defenders should take from Evooo1Bot.
A vulnerability’s publication date tells you when the flaw became known.
It does not tell you when the flaw stops being dangerous.
If vulnerable hardware remains online, the vulnerability remains operationally relevant.
This is especially true for appliances that cannot be easily upgraded or replaced.
The Edge Is Becoming the New Battleground
Enterprise security has historically focused heavily on endpoints and servers.
That remains necessary.
But modern attackers increasingly understand that the edge can offer something endpoints cannot: network position.
A compromised edge appliance can potentially observe traffic patterns, interact with internal infrastructure, provide an outbound path, and conceal attacker activity.
That makes routers, VPN appliances, firewalls, gateways, and specialized network devices increasingly attractive targets.
What Organizations Should Do Now
Organizations should inventory every internet-facing appliance they operate.
That inventory should include the vendor, model, firmware version, management interface exposure, supported security updates, and business owner.
Devices that cannot be patched should be isolated or replaced where practical.
Internet-facing management interfaces should not be exposed unnecessarily.
Unused services should be disabled.
Default credentials should never remain active.
SSH should be restricted to trusted management networks wherever possible.
Network segmentation should prevent an edge compromise from becoming a straightforward route into sensitive internal systems.
Patch Management Needs to Include Appliances
Many organizations have mature patching programs for Windows, macOS, Linux servers, browsers, and applications.
The router sitting at the network perimeter may be a different story.
That gap is dangerous.
Security teams should bring network appliances into the same vulnerability-management lifecycle as traditional endpoints.
A device without a security agent still needs security ownership.
The Mirai Lesson Is Still Not Over
Mirai’s most important legacy may not be its original DDoS capability.
It may be the demonstration that leaked malware source code can become a permanent foundation for future criminal innovation.
Once source code becomes public, attackers do not need to reinvent the entire architecture.
They can modify it.
Add new scanners.
Add new exploits.
Replace the C2 mechanism.
Add encryption.
Add proxy capabilities.
Add credential theft.
And release another generation.
Evooo1Bot Represents That Evolution
The name may be new, but the underlying story is familiar.
Publicly available malware technology is being combined with newly discovered vulnerabilities and increasingly sophisticated operational capabilities.
The result is malware that can move beyond simple botnet economics.
Evooo1Bot is therefore better understood as a Mirai-derived modular intrusion platform rather than merely another DDoS botnet.
What Undercode Say:
1.
Nearly a decade after the original leak, Mirai continues to provide attackers with a proven foundation.
- The Most Dangerous Part Is Not the DDoS Engine
The proxy, credential, scanning, and remote-administration capabilities make Evooo1Bot considerably more versatile.
3. Edge Devices Are Becoming Strategic Assets
A compromised router can provide attackers with network positioning that an ordinary infected workstation may not provide.
4. Old CVEs Can Become Modern Weapons
The campaign demonstrates that attackers will happily exploit vulnerabilities that are many years old when vulnerable systems remain exposed.
- New Vulnerabilities Are Added to the Arsenal
The presence of 2025 vulnerabilities shows that the operators are not relying exclusively on legacy exploits.
6. Automation Is Clearly Important
A large exploit list would be difficult to operate manually at scale.
The structure strongly suggests automated discovery and exploitation.
7. A Shared Loader Simplifies Deployment
Using common loader infrastructure allows attackers to distribute malware across different target architectures and devices.
- The SOCKS Relay Changes the Threat Model
Once an infected device becomes a proxy, the victim’s infrastructure can become part of the attacker’s operational network.
9. Attribution Becomes More Difficult
Traffic routed through compromised infrastructure can obscure the attacker’s original network location.
10. Internal Pivoting Becomes More Plausible
A strategically positioned edge device can potentially provide a path toward otherwise inaccessible network resources.
11. Encryption Makes Signature Detection Harder
Encrypted C2 means defenders increasingly need behavioral and network-level detection.
12. Obfuscation Raises Reverse-Engineering Costs
Multiple layers of cryptographic and XOR-based transformations can slow analysts down without necessarily making the malware undetectable.
13. SSH Remains a Valuable Attack Surface
The presence of SSH brute-force functionality shows that credential-based compromise remains relevant alongside vulnerability exploitation.
14. Credential Theft Makes Infection More Valuable
An attacker gains more options when malware can collect authentication material rather than merely launch DDoS traffic.
15. Modular Malware Is Easier to Evolve
Attackers can add or remove components without rebuilding an entire ecosystem from scratch.
16. Vulnerability Diversity Is a Force Multiplier
Supporting different manufacturers and device categories dramatically increases the number of potential victims.
17. Industrial Devices Deserve Special Attention
The inclusion of ME-RTU-related vulnerabilities highlights the potential overlap between IoT botnets and operational technology environments.
18. Internet Exposure Remains the Critical Variable
A vulnerable device that is completely isolated is a different risk from the same device exposed directly to the internet.
19. Security Teams Need Complete Asset Inventories
You cannot patch hardware you do not know exists.
20. Shadow Infrastructure Is a Serious Problem
Old routers and appliances can remain online long after their original owners stop actively monitoring them.
21. End-of-Life Hardware Is Especially Dangerous
If vendors no longer provide security updates, vulnerability exposure can become permanent.
22. Network Segmentation Can Limit the Damage
Segmentation can prevent a compromised edge appliance from becoming a universal gateway into sensitive systems.
- Outbound Traffic Matters as Much as Inbound Traffic
Security teams should watch what compromised appliances communicate with after exploitation.
- Unexpected Shell Activity Is a Strong Signal
A network appliance executing unusual shell commands deserves immediate investigation.
25. Persistent Connections Deserve Attention
A device that normally handles short-lived network operations should not suddenly maintain unexplained external sessions.
26. IP Blocking Alone Is Not Enough
Attack infrastructure changes rapidly.
Behavior-based detection is more durable than a static blocklist.
- The Loader Infrastructure Provides Useful Threat Intelligence
The observed URL gives defenders a concrete indicator for historical and current hunting.
- But Indicators Have a Short Shelf Life
Infrastructure can change long before the underlying malware family disappears.
29. Mirai Variants Are Not All Equal
Calling malware “Mirai-based” can hide significant differences in functionality and operational intent.
30. Evooo1Bot Demonstrates That Difference Clearly
Its additional capabilities make it much more than a basic DDoS implant.
31. Attackers Are Monetizing Network Position
The value of an infected device increasingly comes from where it sits, not merely how much traffic it can generate.
32. Proxies Can Become Criminal Infrastructure
A compromised device may be used to launch activity against third parties while disguising the attacker’s origin.
33. Security Architecture Must Assume Edge Compromise
Perimeter devices should not automatically be trusted simply because they belong to the organization.
34. Firmware Management Is Cybersecurity
Firmware updates should be treated as security controls, not optional maintenance.
35. Appliance Ownership Must Be Explicit
Every internet-facing device should have someone responsible for monitoring and patching it.
- Old Equipment Should Have a Retirement Plan
“Still working” is not the same as “still secure.”
- The Threat Is Bigger Than One Botnet
Evooo1Bot is another example of an ecosystem that continuously adapts around publicly available malware technology.
- Public Source Code Has a Long Tail
Once dangerous code is released, defenders must assume that future variants will continue to appear.
39. Edge Security Will Become More Important
As organizations deploy more connected appliances, attackers will have more opportunities to weaponize those systems.
40. The Biggest Warning Is Simple
The modern attacker does not necessarily need to break through the strongest system in the network.
Sometimes, they only need to find the forgotten device sitting quietly at the edge.
✅ The Evooo1Bot Vulnerability List Is Consistent With Public Vulnerability Records
The cited 2025 D-Link vulnerabilities are real and documented by NVD, including remote command injection affecting vulnerable firmware. CVE-2025-55583 is particularly serious, with CISA enrichment assigning a 9.8 CVSS score.
✅ The Loader URL Has Been Observed as Malware Infrastructure
URLhaus records 91.92.40.118/wget.sh as a malware-distribution URL and shows that it was observed delivering a shell script associated with Gafgyt.
✅ The D-Link DIR-868L Vulnerability Is Confirmed by the Vendor
D-Link’s security advisory independently documents the unauthenticated command-injection vulnerability in the affected DIR-868L firmware.
⚠️ The More Advanced Evooo1Bot Capabilities Depend on the FortiGuard Analysis
Capabilities such as the 28-command interface, credential sniffer, encryption stack, and SOCKS relay should be attributed to the FortiGuard Labs research rather than presented as independently verified characteristics of every sample associated with the infrastructure.
⚠️ A Malware-Tracking Label Does Not Automatically Prove Family Identity
URLhaus associates the loader with Gafgyt-related malware, while the FortiGuard investigation identifies the campaign as Evooo1Bot. These classifications can overlap because modern Linux botnets frequently share code, infrastructure, and functionality. The evidence should therefore be interpreted as supporting the broader malware ecosystem rather than treating every classification as an exact family determination.
Prediction
(+1) Evooo1Bot Will Likely Continue Expanding Its Exploit Arsenal
The strongest positive prediction for defenders is that increased visibility around this campaign will lead vendors and security teams to identify additional infrastructure, vulnerable devices, and related samples.
(+1) More Mirai-Derived Malware Will Become Operationally Sophisticated
The direction of development is increasingly clear: attackers are moving beyond simple DDoS functionality toward credential theft, proxying, persistence, and network access.
(+1) Edge-Device Monitoring Will Become a Higher Security Priority
Organizations are likely to increase investment in monitoring routers, firewalls, VPN appliances, and other network-connected systems as attackers increasingly recognize their strategic value.
(-1) Unpatched Legacy Appliances Will Remain an Easy Entry Point
The negative prediction is harder to ignore: vulnerable internet-facing equipment will continue to be compromised as long as organizations leave obsolete firmware and unsupported hardware online.
(-1) Mirai Variants Will Continue Recycling Old Vulnerabilities
Attackers have little reason to abandon an exploit that still works. The combination of old and new CVEs suggests that vulnerability age will remain a poor indicator of practical exploitation risk.
Final Assessment: The Next Mirai May Not Look Like Mirai
Evooo1Bot is a warning about how dramatically the Linux botnet ecosystem has evolved.
The basic Mirai concept was simple: compromise exposed devices, build a botnet, and use that botnet to generate enormous amounts of traffic.
The modern version is much more ambitious.
Compromise the edge device.
Establish encrypted communications.
Scan for additional victims.
Steal credentials.
Maintain access.
Create a proxy.
Move traffic through the victim.
And potentially use the compromised network position for operations far beyond DDoS.
That is why Evooo1Bot deserves attention.
The danger is not merely that another Mirai descendant has appeared. The deeper problem is that the infrastructure surrounding internet-connected devices continues to provide attackers with enormous amounts of inexpensive, poorly monitored computing power and strategically valuable network access.
The lesson for defenders is therefore straightforward: patch the routers, inventory the appliances, restrict management interfaces, monitor outbound traffic, investigate unexpected proxy behavior, and retire equipment that can no longer be secured.
Because in 2026, the device sitting quietly at the edge of the network may no longer be just a router.
It could be the
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
