Listen to this Post
Introduction: When a Router Quietly Becomes an Attacker’s Machine
A router, firewall, IP camera, industrial gateway, or other internet-facing Linux device can look completely normal to its owner while secretly becoming part of a criminal infrastructure operating halfway around the world. That is the danger highlighted by the discovery of Evooo1Bot, a previously undocumented Linux botnet family that takes the familiar Mirai botnet formula and pushes it into a much more versatile and potentially profitable direction.
A New Generation of Mirai-Inspired Malware
According to research attributed to Fortinet FortiGuard Labs, Evooo1Bot has been active in the wild since at least July 2026 and is designed to compromise publicly accessible devices by exploiting known vulnerabilities. Fortinet’s broader threat-research work continues to document how exposed edge devices and IoT systems remain attractive targets for botnet operators.
More Than Another DDoS Botnet
The most important detail is that Evooo1Bot is not simply another Mirai descendant built to flood websites with traffic. Its architecture reportedly combines DDoS functionality with encrypted command-and-control communications, SSH brute-force capabilities, credential interception, vulnerability exploitation, file transfers, interactive shell access, persistence, and a SOCKS5 proxy module.
Why the SOCKS5 Capability Changes Everything
Turning an infected device into a SOCKS5 proxy gives an attacker something considerably more valuable than a disposable DDoS node. The compromised device can become a relay through which other traffic is routed, making the victim’s public IP address appear to be the origin of activity that actually belongs to the attacker.
The Victim’s IP Address Becomes the Attacker’s Mask
This creates an uncomfortable scenario for organizations and individuals. A compromised router inside a residential or corporate network can potentially be used to hide malicious traffic, bypass geographic restrictions, reach otherwise inaccessible systems, or make subsequent investigations more complicated.
From Botnet to Distributed Proxy Infrastructure
At scale, thousands of compromised devices could form a distributed proxy network. That creates possibilities for anonymous traffic forwarding and potentially monetized proxy services. The same infrastructure that began as a collection of compromised routers could therefore become a criminal access platform.
The Mirai Connection
Evooo1Bot reportedly reuses the DDoS engine derived from the publicly leaked Mirai source code. This is hardly surprising. Mirai demonstrated years ago that internet-connected devices with weak security could be transformed into enormous botnets, and its leaked source code effectively became a foundation that later malware families could repeatedly modify.
Mirai’s Legacy Continues
Fortinet has previously documented how Mirai-derived malware can borrow substantial portions of its architecture while adding new capabilities and business models. The continuing appearance of Mirai variants demonstrates that leaked malware source code can remain operationally relevant long after the original campaign disappears.
The Initial Infection Starts With Old Vulnerabilities
One of the most concerning aspects of Evooo1Bot is the age of several vulnerabilities reportedly targeted by its exploitation framework. The campaign illustrates an uncomfortable truth in cybersecurity: attackers frequently do not need a sophisticated zero-day when thousands of internet-facing devices remain exposed to vulnerabilities that have been known for years.
Vulnerabilities Reportedly Targeted by Evooo1Bot
The reported exploitation list includes vulnerabilities affecting a wide range of networking, telecommunications, industrial, surveillance, and embedded equipment:
CVE-2007-3010 – Alcatel OmniPCX Enterprise remote code execution vulnerability.
CVE-2016-6277 – NETGEAR router remote code execution vulnerability.
CVE-2018-14558 – Tenda AC7, AC9, and AC10 command injection vulnerability.
CVE-2019-14931 – Mitsubishi Electric Europe and INEA ME-RTU remote command injection vulnerability.
CVE-2020-10987 – Tenda AC15 router remote code execution vulnerability.
CVE-2021-46422 – Telesquare SDT-CW3B1 command injection vulnerability.
CVE-2022-37055 – D-Link router buffer overflow vulnerability.
CVE-2024-29269 – Telesquare TLR-2005KSH command injection vulnerability.
CVE-2025-10123 – D-Link DIR-823X command injection vulnerability.
CVE-2025-55583 – D-Link DIR-868L B1 command injection vulnerability.
The Age of a Vulnerability Does Not Protect You
A vulnerability from 2007 may sound irrelevant in 2026. It is not. If an old device remains deployed, connected to the internet, and vulnerable, its age provides absolutely no protection.
The Loader Arrives After Exploitation
Following successful exploitation, the infection process reportedly downloads a shell script called wget.sh from an external server and uses it to retrieve a binary matching the CPU architecture of the compromised device.
Multi-Architecture Malware Makes IoT Botnets Dangerous
This architecture-aware approach is particularly useful against the fragmented Linux and embedded-device ecosystem. Routers and IoT products can run on ARM, MIPS, x86 and other processor architectures, meaning a malware family that wants broad coverage must be able to adapt its payload to the hardware it encounters.
Attackers Also Try to Erase Their Footprints
The reported loader clears Bash history after executing its commands. That is a simple technique, but it demonstrates the operational mindset behind the campaign.
The Malware Looks Before It Acts
Evooo1Bot reportedly checks the infected environment for analysis tools, sandboxes, and virtual environments before proceeding. This suggests that the malware is not blindly executing on every system it reaches.
Evasion Makes Automated Analysis Harder
Sandbox detection can help malware distinguish a genuine victim from a controlled research environment. That matters because security researchers frequently analyze malware inside virtual machines and automated sandboxes.
Encrypted C2 Over Port 443
Once active, the malware establishes encrypted communications with its command-and-control infrastructure over TCP port 443.
Why Port 443 Is Attractive
Port 443 is normally associated with HTTPS traffic. Using it for encrypted command-and-control communications can make malicious activity less conspicuous at network boundaries, especially on networks where outbound HTTPS traffic is common.
Registration Comes Before Commands
After connecting to the C2 infrastructure, the compromised machine reportedly registers itself and waits for instructions. At that point, the infected device is no longer merely a vulnerable endpoint. It becomes a remotely controlled asset.
A Remote-Controlled Swiss Army Knife
The command set reportedly allows operators to perform a surprisingly broad range of actions, including installing persistence, updating the malware, terminating the bot, transferring files, opening an interactive shell, intercepting HTTP authentication information and cookies, enabling proxy functionality, launching SSH brute-force activity, performing DDoS attacks, and activating vulnerability exploitation.
Credential Interception Raises the Stakes
The ability to intercept HTTP Basic Authorization and Cookie headers can potentially expose authentication material passing through a compromised device. This makes the malware relevant to more than bandwidth abuse.
An Infected Router Can Become a Surveillance Point
The location of a compromised edge device is strategically important. Traffic passing through routers and gateways can reveal information about connected systems, services, authentication attempts, and network behavior depending on the device’s configuration and the attacker’s access.
The Exploit Arsenal Keeps Expanding
The
Reported Exploitation Targets Include
The reported exploit dispatcher includes:
CVE-2021-36260 – Hikvision command injection.
CVE-2022-26134 – Atlassian Confluence vulnerability.
CVE-2022-29464 – WSO2 vulnerability.
CVE-2022-30525 – Zyxel vulnerability.
CVE-2023-1389 – TP-Link vulnerability.
CVE-2024-4577 – PHP vulnerability.
CVE-2024-10914 – D-Link vulnerability.
CVE-2025-1974 – Kubernetes-related vulnerability.
One Botnet, Multiple Attack Paths
This is what makes Evooo1Bot especially interesting from a defensive perspective. Instead of depending on a single infection technique, it reportedly combines several paths into one framework.
Vulnerability Exploitation Provides Scale
Known vulnerabilities allow automated scanning and mass exploitation. The attackers can continuously search the internet for devices that have not been patched or replaced.
SSH Brute-Force Provides Another Door
When vulnerability exploitation fails, exposed SSH services and weak credentials can provide an alternative route into a device.
Proxying Creates an Underground Infrastructure
Once compromised, the device can potentially become a relay. This gives the attacker an additional use for the infection even when DDoS activity is not taking place.
DDoS Remains Part of the Arsenal
The malware reportedly retains DDoS functionality across DNS, TCP, UDP, and HTTP-related attack mechanisms. That preserves the traditional Mirai-style purpose while adding capabilities that make infected hosts useful for other criminal operations.
The Real Evolution Is Economic
The biggest evolution is arguably not technical. It is economic.
Why Criminals Want Proxy Nodes
A DDoS botnet is useful when attackers want to overwhelm a target. A proxy network can be useful repeatedly for reconnaissance, credential abuse, fraud, scraping, bypassing geographic controls, accessing restricted services, and hiding the origin of traffic.
Compromised Infrastructure Can Become a Commodity
If thousands of routers and IoT devices can be converted into proxy endpoints, attackers may have an infrastructure asset that can potentially be reused or monetized rather than consumed in a single DDoS operation.
This Is Why Edge Devices Matter
Security teams traditionally focus heavily on servers, workstations, cloud workloads, and employee endpoints. Routers, cameras, firewalls, and embedded appliances can receive less attention because they are often treated as appliances rather than computers.
But They Are Computers
They have processors, operating systems, network interfaces, storage, credentials, services, and firmware. Once exposed to the internet, they become part of the organization’s attack surface.
The Silent Infection Problem
One of the greatest dangers is visibility. A compromised workstation may generate obvious alerts. A compromised router can continue forwarding packets normally while simultaneously performing malicious tasks in the background.
What Makes Evooo1Bot Particularly Concerning
The combination of vulnerability exploitation, credential interception, proxying, persistence, encrypted C2, brute-force scanning, and DDoS functionality creates a flexible platform.
The Botnet Can Change Jobs
Today the infected host may be used as a proxy. Tomorrow it could receive an updated binary or a new command. The operator does not necessarily need to reinfect the device to change its purpose.
Persistence Extends the Attack Window
The ability to install persistence means that simply rebooting the device may not be sufficient in every infection scenario. Administrators need to investigate the underlying compromise rather than assuming a restart automatically solves the problem.
Patch Management Is Still the First Line of Defense
The long list of vulnerabilities associated with the campaign reinforces a basic security lesson: exposed infrastructure must be patched, replaced, isolated, or removed.
Internet Exposure Should Be Minimized
Management interfaces should not be unnecessarily reachable from the public internet. Administrative services should be restricted to trusted networks, VPNs, or dedicated management segments whenever practical.
Default Credentials Are Still Dangerous
Strong unique credentials remain essential for routers, cameras, firewalls, industrial gateways, and other embedded devices. Where supported, organizations should also use stronger authentication mechanisms and disable unused accounts.
Network Segmentation Limits the Damage
If an internet-facing appliance becomes compromised, segmentation can prevent the attacker from freely reaching internal systems.
Outbound Traffic Deserves Attention Too
Security teams often concentrate on inbound exploitation. Evooo1Bot demonstrates why outbound monitoring matters as well.
A Router Suddenly Acting Like a Proxy Is Suspicious
Unexpected outbound connections, unusual SOCKS-like traffic, unexplained encrypted sessions, repeated connections to unfamiliar infrastructure, or sudden scanning behavior can indicate compromise.
DNS and Network Behavior Can Reveal Botnet Activity
An edge device generating large volumes of outbound connections, participating in unusual DNS traffic, or contacting multiple external systems at unusual intervals deserves investigation.
The Broader Mirai Problem Is Not Going Away
Fortinet’s own historical research demonstrates how Mirai and its descendants continue to influence IoT botnet development. Recent Fortinet research has also documented other vulnerability-driven botnet activity targeting exposed devices.
What Undercode Say:
- Evooo1Bot Represents the Next Logical Step for IoT Botnets
The Mirai formula has evolved from simple DDoS automation into multifunctional infrastructure.
- The Proxy Module Is the Most Strategically Important Feature
DDoS capabilities are dangerous, but proxying gives attackers an enduring operational resource.
- A Compromised IP Address Has Real Criminal Value
Attackers can potentially make activity appear to originate from the victim’s network.
- Residential Networks Could Become Unwitting Exit Nodes
A home router could unknowingly provide an attacker with an apparently legitimate residential IP address.
- Enterprise Edge Devices Are Even More Valuable
A compromised corporate gateway may provide access to networks that are invisible from the public internet.
6. Old Vulnerabilities Remain Weapons
The presence of vulnerabilities dating back many years demonstrates how slowly some embedded-device ecosystems are maintained.
- IoT Patch Management Is Still Broken in Many Environments
Organizations often lack complete inventories of every internet-facing appliance they operate.
- Unsupported Hardware Is a Serious Security Problem
A device that no longer receives security updates should not remain exposed indefinitely.
9.
Once malware source code is publicly available, defenders cannot simply expect the original threat to disappear.
10. Attackers Can Reuse Proven Code
They can spend their development resources adding features instead of rebuilding basic botnet infrastructure.
11. Evooo1Bot Shows the Value of Modularity
Separate components allow operators to adapt infections to different objectives.
12. Modular Malware Is Easier to Repurpose
The same compromised host can potentially perform several jobs without being replaced.
13. Encrypted C2 Is Becoming Normal
Attackers increasingly hide command traffic inside encrypted communication channels.
14. Port 443 Provides Natural Cover
HTTPS dominates modern internet traffic, making encrypted communications over that port less immediately suspicious.
- Encryption Does Not Mean Traffic Is Invisible
Defenders can still examine destinations, timing, frequency, volume, certificates, fingerprints, and behavioral patterns.
- Credential Sniffing Makes Edge Compromise More Dangerous
The attacker may gain information beyond simple control of the device.
17. Cookies Can Become Valuable Authentication Material
Session information can sometimes provide access without requiring the original password.
18. SSH Brute-Force Expands the Attack Surface
The botnet can search for additional devices and potentially propagate its presence.
- Exploit Automation Makes Human Attackers More Efficient
The botnet can continuously perform repetitive vulnerability-testing operations at internet scale.
- DDoS Is Still a Core Business Model
The inclusion of proxy functionality does not eliminate the traditional botnet economy.
- The Two Capabilities Can Reinforce Each Other
A large collection of compromised devices provides both attack bandwidth and relay infrastructure.
22. Edge Devices Need Endpoint-Like Security
They should be inventoried, monitored, updated, and investigated like other computing assets.
23. Security Teams Should Monitor Appliances
A firewall or router should not automatically be considered trustworthy simply because it sits at the network perimeter.
- Firmware Needs the Same Security Discipline as Software
Firmware vulnerabilities can remain exploitable for years when manufacturers or owners fail to update devices.
- Exposure Is Often More Dangerous Than Complexity
An ordinary vulnerable device exposed to the internet can become more attractive than a sophisticated system hidden behind multiple defensive layers.
26. Attackers Prefer Automation
Automated exploitation allows campaigns to search continuously instead of relying on manual targeting.
- The Internet Is Still Full of Forgotten Devices
Old routers, cameras, gateways, and industrial appliances can remain online long after administrators stop thinking about them.
28. Asset Inventory Is a Security Control
You cannot patch or monitor equipment you do not know exists.
- Network Segmentation Can Break the Attack Chain
A compromised edge appliance should not automatically provide unrestricted access to internal systems.
30. Egress Filtering Deserves More Attention
Restricting unnecessary outbound connections can make compromised devices less useful to attackers.
31. Behavioral Detection Can Beat Static Detection
Even when malware changes its filename or binary, its network behavior may remain suspicious.
- Proxy Detection Should Become Part of IoT Monitoring
Unexpected relay behavior from a router or camera deserves immediate investigation.
33. Repeated C2 Connections Are Valuable Indicators
Persistent beaconing can expose compromised infrastructure even when payload contents are encrypted.
34. DDoS Traffic Can Reveal Infections
A device suddenly generating unusual volumes of outbound traffic should be investigated.
35. Brute-Force Scanning Can Reveal Botnet Participation
A router attempting SSH connections against numerous external systems is not normal behavior for most deployments.
- The Threat Is Bigger Than One Malware Family
Evooo1Bot is another example of a broader ecosystem exploiting exposed edge infrastructure.
37. Defenders Should Focus on the Pattern
The important lesson is not simply the name Evooo1Bot. The pattern is vulnerability exploitation followed by persistence, C2 control, credential access, proxying, and abuse.
38. Mirai Keeps Teaching the Same Lesson
Internet-connected devices become dangerous when security becomes an afterthought.
- The Proxy Economy Could Drive Further Botnet Growth
If compromised devices can be monetized as relay nodes, attackers have an incentive to maintain infections rather than simply use them for one-off attacks.
- The Best Defense Is to Make the Device Uninteresting
Patch it, remove unnecessary internet exposure, disable unused services, strengthen authentication, segment it, monitor it, and replace it when it can no longer be securely maintained.
Deep Analysis: How Defenders Can Investigate Suspicious Linux and Edge Devices
Check Running Processes
On a Linux-based system, administrators can begin with a basic process review:
ps aux --sort=-%cpu | head -30
Inspect Network Connections
Unexpected outbound connections can provide an early clue:
ss -tupan
Look for Listening Services
Identify services that should not be exposed:
ss -lntup
Review Recent Authentication Activity
SSH activity can be investigated with:
last
and, depending on the Linux distribution:
grep -i "failed|accepted" /var/log/auth.log | tail -100
Search for Suspicious Persistence
Administrators should examine scheduled tasks:
crontab -l sudo ls -la /etc/cron.d/ sudo ls -la /etc/cron.daily/
Inspect System Services
Systemd-based systems can be reviewed with:
systemctl list-unit-files --state=enabled
Review Recent File Changes
A useful starting point for suspicious files is:
find /tmp /var/tmp /dev/shm -type f -mtime -7 -ls 2>/dev/null
Check Shell History Carefully
Because malware can attempt to erase shell history, missing or unexpectedly truncated history should not automatically be interpreted as evidence that nothing happened.
Examine Outbound Traffic
Network monitoring should look for repeated connections to unfamiliar external infrastructure, unexpected encrypted sessions, unusual DNS behavior, and traffic patterns inconsistent with the device’s normal role.
Compare Against a Known-Good Baseline
The strongest detection often comes from knowing what a router, camera, gateway, or server normally does. A device that suddenly begins scanning SSH services or acting as a proxy has changed its behavioral profile.
Preserve Evidence Before Rebuilding
If compromise is suspected, organizations should preserve relevant logs, network telemetry, firmware information, configuration backups, and forensic artifacts before wiping or replacing the device whenever incident-response requirements demand evidence preservation.
Rebuild Rather Than Trust a Compromised System
For high-confidence compromise, restoring a device to a trusted firmware image and changing credentials is generally safer than assuming suspicious files can simply be deleted.
Rotate Credentials After Containment
Any credentials that may have been exposed through the compromised appliance should be considered potentially compromised and rotated according to the organization’s incident-response procedures.
Accuracy Assessment
✅ The core Evooo1Bot description is consistent with current reporting: the malware is described as a Mirai-derived Linux botnet with DDoS, exploitation, credential, C2, and SOCKS5 proxy capabilities.
✅ The broader Mirai context is well established: Fortinet has documented Mirai and multiple Mirai-derived botnets, including variants that reuse leaked Mirai code.
⚠️ The detailed Evooo1Bot technical indicators and CVE list should be attributed to the reported FortiGuard research: independent public search results available at publication time did not provide a directly accessible Fortinet page reproducing every technical detail in the supplied report. The core description is corroborated by recent public discussion, but individual IOCs and implementation details should be treated as research-specific rather than independently verified facts.
Prediction
(+1) Evooo1Bot Will Likely Become More Capable
As researchers and defenders identify its infrastructure, operators are likely to modify binaries, rotate C2 infrastructure, expand supported architectures, and add new exploitation modules.
(+1) Proxy Functionality Will Become More Important
The ability to convert compromised edge devices into relay nodes provides a reusable resource that can support multiple criminal activities.
(+1) Old IoT Vulnerabilities Will Continue to Be Exploited
Attackers have little incentive to abandon vulnerabilities that still produce successful infections.
(+1) Edge Security Will Receive More Attention
The growing use of routers, cameras, firewalls, industrial gateways, and other appliances as criminal infrastructure will push organizations toward stronger asset inventories and network-level monitoring.
(-1) Unpatched Devices Will Remain an Easy Entry Point
Organizations that leave vulnerable internet-facing equipment exposed will continue to provide botnet operators with inexpensive opportunities for mass compromise.
(-1) Unsupported Hardware Will Become an Increasing Liability
Devices that cannot receive modern firmware updates will become progressively harder to defend against evolving malware.
Final Verdict: The Router Is No Longer Just a Router
Evooo1Bot Changes the Meaning of an IoT Infection
The most important lesson from Evooo1Bot is not that another Mirai variant has appeared. Mirai-inspired malware has been around for years. The important development is how much value attackers can extract from a single compromised device.
One Device Can Perform Many Jobs
A vulnerable router can potentially become a DDoS participant, vulnerability scanner, credential interception point, SSH brute-force platform, command shell, file-transfer endpoint, and SOCKS5 proxy.
The Criminal Infrastructure Is Becoming More Flexible
That flexibility makes modern botnets harder to dismiss as simple DDoS networks. They are increasingly becoming distributed computing and networking platforms controlled by criminals.
The Defensive Lesson Is Straightforward
Organizations should treat every internet-facing appliance as a computer that can be attacked, compromised, monitored, and abused.
Patch What Can Be Patched
Remove vulnerable devices from public exposure whenever possible, update firmware, disable unnecessary services, replace unsupported hardware, strengthen authentication, segment networks, and monitor outbound behavior.
The Biggest Warning Is Already Visible
Evooo1Bot does not need a revolutionary vulnerability to be dangerous. It can reportedly combine old weaknesses, exposed devices, automated exploitation, and modular malware into a scalable criminal infrastructure.
The Internet Keeps Forgetting, Attackers Do Not
Every forgotten router, unpatched camera, exposed gateway, and unsupported appliance represents another potential node.
And once that device silently becomes part of a proxy network, the attack may no longer be coming from somewhere far away.
It may be coming from the device sitting inside your own network.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
