Listen to this Post
A New Threat Is Quietly Targeting the Devices That Defend Our Networks
The security industry is once again facing a familiar problem with a more modern and capable face: internet-connected devices are being transformed into weapons without their owners realizing it. FortiGuard Labs has uncovered a previously undocumented Linux botnet named Evooo1Bot, a malware family that appears specifically designed to compromise exposed routers, firewalls, cameras, networking appliances, and other edge devices.
The discovery is particularly concerning because Evooo1Bot is not simply another Mirai clone. Although its distributed-denial-of-service engine appears to borrow heavily from the leaked Mirai source code, researchers found a much broader collection of capabilities inside the malware. The botnet can perform DDoS attacks, operate SOCKS5 proxy services, steal credentials, scan networks, brute-force SSH services, sniff traffic, execute commands remotely, transfer files, maintain persistence, and exploit known vulnerabilities.
That combination changes the threat considerably.
A compromised router is no longer just another machine participating in a DDoS attack. It can become a foothold inside a network, a traffic relay, a credential-harvesting platform, a reconnaissance system, and a persistent remote-access point for attackers.
The Campaign Has Been Active Since July 2026
FortiGuard telemetry indicates that the Evooo1Bot campaign has been active since July 2026, with researchers observing exploitation attempts designed to identify vulnerable internet-facing devices and deliver malware automatically.
One observed infection chain uses a loader hosted at:
http://91.92.40[.]118/wget.sh
The address has been intentionally defanged here to prevent accidental access.
The shell script first determines the CPU architecture of the targeted device. It then downloads the appropriate Linux malware binary, changes its permissions so that it can execute, and launches the payload.
This architecture-aware approach is important because networking equipment does not necessarily use the same processor architecture as conventional desktop computers or servers. Attackers therefore need malware capable of adapting to ARM, MIPS, x86, and other environments commonly found in embedded hardware.
Once execution succeeds, the malware also attempts to remove traces by clearing Bash history.
Evooo1Bot Is More Than a DDoS Bot
The most important aspect of Evooo1Bot is the breadth of its functionality.
Its DDoS capabilities appear to be derived from the leaked Mirai codebase, which has influenced countless IoT malware families since Mirai first demonstrated how vulnerable connected devices could be weaponized at massive scale.
But Evooo1Bot extends that foundation.
The malware reportedly includes encrypted command-and-control communication, SSH brute-force scanning, traffic sniffing, remote shell access, file upload and download functionality, persistence mechanisms, self-update capabilities, and an exploit module capable of targeting known vulnerabilities.
This means the botnet has characteristics of several threat categories at once.
It can function as an IoT botnet.
It can operate as a proxy network.
It can act as a remote-access implant.
It can perform network reconnaissance.
And, under the right circumstances, it can provide attackers with a foothold for deeper intrusion.
Vulnerable Networking Products Are Sitting Directly in the Crosshairs
FortiGuard researchers observed Evooo1Bot targeting a wide variety of networking and edge-device technologies.
The affected target categories include products associated with Alcatel OmniPCX, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and multiple D-Link models.
The diversity of these targets highlights a fundamental problem with internet-facing infrastructure: attackers do not need to compromise one dominant vendor to build a successful botnet.
Instead, they can search across many vendors, architectures, firmware versions, and device types.
A vulnerability that looks relatively minor when examined in isolation can therefore become extremely valuable when automated at scale.
The Attackers Appear to Track Which Exploits Work
One particularly interesting detail is that campaign labels embedded in download commands appear to indicate that the operators monitor infection success according to vulnerability and device type.
This suggests an organized operational workflow rather than random scanning.
An attacker can determine which vulnerability successfully compromises a particular class of equipment, identify which payload architecture works against the device, and then optimize future campaigns accordingly.
In other words, the botnet infrastructure can effectively become a feedback system.
Every successful infection provides information.
Every failed exploit provides information.
Every vulnerable device becomes another data point that can improve the campaign.
Encryption Helps Hide
Evooo1Bot also demonstrates considerable effort to conceal its internal configuration and operational details.
FortiGuard researchers observed the use of AES, ChaCha20, and XOR-based routines to protect strings and configuration data.
The malware reportedly separates encryption keys into different data blocks and reconstructs them only while running.
That technique makes static analysis more difficult because analysts examining the binary may not immediately see the complete configuration in readable form.
For defenders, this reinforces a broader lesson: malware analysis cannot depend entirely on searching binaries for obvious IP addresses, domains, commands, or plaintext configuration strings.
Modern malware increasingly treats its own configuration as something that must be protected from investigators.
Evooo1Bot Knows When Someone Is Watching
Perhaps one of the more worrying characteristics is the malware’s anti-analysis functionality.
Before establishing communication with its command-and-control infrastructure, Evooo1Bot checks for a collection of security and reverse-engineering tools.
These include:
gdb
Wireshark
tcpdump
IDA
Ghidra
YARA
Valgrind
The malware also looks for indicators associated with virtual machines, sandboxes, containers, and malware-analysis environments, including environments associated with VMware, VirtualBox, QEMU, and Docker-like infrastructure.
This creates an uncomfortable challenge for researchers.
A sample may behave differently when it believes it is being analyzed than when it is operating on a genuine victim device.
That can delay detection, complicate reverse engineering, and allow malware operators to maintain an advantage over defenders.
Port 443 Gives the Botnet an Opportunity to Blend In
After completing its preliminary checks, Evooo1Bot communicates with its command-and-control infrastructure over TCP port 443.
Port 443 is normally associated with HTTPS traffic, making it one of the most commonly used ports on the internet.
Using a familiar port does not automatically make malicious traffic invisible, but it can make simple port-based filtering less effective.
This is an important distinction for security teams.
A firewall rule allowing outbound TCP 443 does not necessarily mean that every connection using that port is legitimate.
The real question is where the connection is going, which process initiated it, how the traffic behaves, and whether the destination has a legitimate relationship with the device.
Remote Shell Access Makes the Threat Much More Serious
Evooo1Bot supports commands that allow operators to collect system information, terminate processes, update the malware, upload and download files, and establish interactive shell access.
The malware can reportedly create a pseudo-terminal and execute commands in the background.
That capability moves the threat well beyond traditional botnet behavior.
An attacker who gains shell access to an edge device can potentially inspect local configuration, discover network relationships, identify credentials, collect information about connected systems, and use the compromised device as a launching point for additional activity.
The router or firewall becomes the
Persistence Gives Evooo1Bot a Longer Life
A sophisticated malware family cannot rely exclusively on the first execution.
Evooo1Bot therefore implements several persistence techniques.
Researchers observed mechanisms involving a fake systemd service named “Apache HTTPD Cache Manager,” SysV initialization scripts, cron jobs, shell-profile modifications, and changes involving rc.local.
Using multiple persistence mechanisms can increase the chances that the malware survives configuration changes, service restarts, or partial remediation.
It also makes incident response more complicated.
Removing one malicious startup mechanism may not be enough if another remains active.
The Malware Attempts to Protect Its Own Resources
Evooo1Bot reportedly goes even further by attempting to remain operational when the compromised system is under resource pressure.
The malware can adjust its out-of-memory killer score and keep a watchdog device open.
The objective is straightforward: remain alive.
This illustrates how modern botnets increasingly behave like persistent software platforms rather than disposable malware processes.
The attacker wants the compromised device to remain useful for as long as possible.
Why Edge Devices Are Such Attractive Targets
Routers, firewalls, cameras, industrial networking devices, VoIP equipment, and other edge appliances occupy a unique position in corporate networks.
They are often internet-facing.
They frequently run specialized Linux-based operating systems.
They may remain operational for years.
They can be difficult to patch.
And security teams sometimes monitor them less closely than traditional servers and endpoints.
That combination creates an attractive attack surface.
A vulnerable laptop may eventually be replaced.
A vulnerable networking appliance may remain online continuously because taking it offline could disrupt an entire organization.
Attackers understand this.
Deep Analysis: How Defenders Can Investigate Evooo1Bot
Check for Unexpected Network Connections
On Linux systems, defenders can begin by reviewing active network connections:
ss -tulpn
For established connections:
ss -tpn state established
Investigators can also review listening services:
ss -lntup
Look for unexpected processes listening on unusual ports or establishing persistent outbound connections.
Search for Suspicious Persistence
Review systemd services:
systemctl list-unit-files --type=service
Then inspect recently modified service files:
find /etc/systemd/system /usr/lib/systemd/system -type f -mtime -14 -ls
Check cron configurations:
crontab -l ls -la /etc/cron.d/ ls -la /etc/cron.daily/
Also inspect initialization mechanisms where applicable:
grep -RniE 'wget|curl|chmod|/tmp/|/var/tmp/' /etc/systemd /etc/init.d /etc/cron 2>/dev/null
These commands are intended for defensive investigation on systems you administer.
Search for the Reported Infrastructure
Security teams can search their SIEM, firewall, DNS, proxy, and NetFlow logs for the reported infrastructure indicator:
91.92.40[.]118
The loader URL reported by FortiGuard is:
http://91.92.40[.]118/wget.sh
Do not access the URL simply to investigate it. Search historical telemetry, firewall records, DNS logs, and endpoint/network data instead.
Examine Bash History Carefully
Because the malware reportedly attempts to clear Bash history, the absence of history should not automatically be interpreted as evidence that nothing happened.
Defenders should correlate multiple sources:
last journalctl --since "7 days ago" journalctl -u ssh --since "7 days ago"
Where available, authentication records should also be examined for unexpected SSH activity.
Investigate Suspicious Downloads
Search shell scripts and temporary directories for recently downloaded executable files:
find /tmp /var/tmp /dev/shm -type f -mtime -14 -ls
Look for unexpected executable permissions:
find /tmp /var/tmp /dev/shm -type f -perm /111 -ls
These locations are commonly abused by malware, although legitimate applications can use them as well.
Review SSH Activity
Because Evooo1Bot includes SSH brute-force functionality, defenders should inspect authentication logs for repeated failed attempts and unexpected successful logins.
For systems using systemd:
journalctl -u ssh --since "24 hours ago"
On distributions using sshd as the service name:
journalctl -u sshd --since "24 hours ago"
The exact log location and service name depend on the Linux distribution and device implementation.
What Makes Evooo1Bot Different From Older Mirai Campaigns
Mirai Was the Blueprint
Mirai demonstrated that poorly secured IoT infrastructure could be converted into a massive distributed weapon.
Its legacy continues to influence modern botnets.
Evooo1Bot Builds on That Foundation
Evooo1Bot appears to retain the DDoS-oriented DNA of Mirai while adding capabilities designed for deeper access, stealth, persistence, reconnaissance, and remote control.
The Threat Is Moving Toward Multi-Purpose Compromise
This evolution matters because the value of an infected device is no longer limited to bandwidth.
A compromised router can potentially provide access, intelligence, anonymity, credentials, and network visibility.
Edge Security Is Becoming Endpoint Security
Security teams increasingly need to treat routers, firewalls, cameras, and other appliances like conventional endpoints.
They require patch management, monitoring, configuration control, authentication security, logging, and incident-response procedures.
What Undercode Say:
The Real Danger Is Not the DDoS Capability
DDoS attacks attract attention because they are visible and disruptive, but the deeper danger is what happens before and after the attack.
A Compromised Router Can Become a Strategic Asset
Attackers can use edge devices as infrastructure rather than simply as disposable bots.
SOCKS5 Proxy Capability Changes the Equation
Proxy functionality can allow attackers to route traffic through compromised networks and obscure the true origin of activity.
Remote Shell Access Is Especially Concerning
Interactive shell access gives operators significantly more flexibility than a conventional DDoS-only implant.
Persistence Indicates Long-Term Intent
Multiple startup mechanisms suggest that maintaining access is an important objective.
Anti-Analysis Shows Increasing Malware Maturity
Checking for Ghidra, IDA, YARA, Wireshark, and debugging tools demonstrates that the developers expect professional analysis.
The Use of Port 443 Is Not Surprising
Attackers have long understood that common network ports can help malicious communication hide among legitimate traffic.
Encryption Makes Static Detection Harder
AES, ChaCha20, and XOR-based configuration protection can frustrate basic signature-based inspection.
Vulnerability Diversity Is a Major Advantage for Botnet Operators
Supporting multiple vendors gives attackers more opportunities to expand their victim pool.
Old Vulnerabilities Remain Valuable
Attackers do not need a brand-new zero-day when thousands of internet-facing devices remain unpatched.
Edge Devices Often Have Weak Visibility
Many organizations have excellent endpoint telemetry but limited visibility into routers and specialized appliances.
That Visibility Gap Is Dangerous
Attackers naturally move toward areas where defenders see less.
Automated Exploitation Changes the Economics
Once exploitation is automated, attackers can test enormous numbers of devices at relatively low cost.
Architecture Detection Is a Practical Requirement
Embedded Linux devices vary significantly in processor architecture.
The Loader Reflects That Reality
Automatically selecting an architecture-specific payload makes mass exploitation more efficient.
Clearing Bash History Is a Classic Anti-Forensic Technique
It shows that the operators care about reducing obvious evidence.
But Deleting One Log Does Not Erase the Attack
Network telemetry, authentication records, filesystem timestamps, process data, and centralized logs can preserve evidence.
Multiple Persistence Methods Increase Response Complexity
Incident responders must search beyond one service or cron entry.
Fake Service Names Can Exploit Administrator Trust
A service that appears related to Apache or another legitimate technology deserves careful validation.
Resource Protection Reveals Malware Priorities
Attempts to survive memory pressure demonstrate that the botnet values persistence and uptime.
The Malware Is Effectively Protecting Its Investment
Every infected system represents infrastructure that the operator wants to keep.
Mirai’s Source Code Continues to Cast a Long Shadow
The public availability of mature botnet techniques continues to influence new malware families.
But Modern Operators Are Adding More Layers
Today’s botnets increasingly combine DDoS, proxying, credential attacks, exploitation, persistence, and remote access.
This Convergence Makes Classification Harder
Evooo1Bot cannot be viewed simply as an IoT DDoS bot.
It Resembles an Initial-Access Platform
Its exploitation and remote-access capabilities potentially make it useful for activities beyond DDoS.
Network Defenders Should Reconsider Their Asset Inventory
Every internet-facing appliance should have an owner, firmware baseline, monitoring strategy, and patching process.
Unsupported Devices Are Especially Dangerous
If a vendor no longer provides security updates, the risk can continue growing even when administrators follow normal procedures.
Internet Exposure Should Be Minimized
Management interfaces should not be directly exposed to the public internet unless there is a compelling operational requirement.
Strong Authentication Is Essential
Default credentials and weak SSH passwords remain attractive targets for automated campaigns.
Network Segmentation Can Limit Damage
A compromised edge device should not automatically provide unrestricted access to critical internal systems.
Egress Monitoring Matters
Organizations should monitor unexpected outbound connections from devices that normally have highly predictable communication patterns.
Centralized Logging Is Critical
Attackers can erase local evidence, but centralized telemetry can preserve the activity.
Detection Should Focus on Behavior
Searching for a single malware hash is not enough when attackers can modify binaries and infrastructure.
Security Teams Should Watch for Anomalies
Unexpected shell activity, unusual outbound traffic, new services, unexplained cron jobs, and sudden configuration changes are meaningful indicators.
The Biggest Lesson Is Architectural
The security perimeter is no longer simply the firewall protecting the organization.
The Firewall Itself Can Become the Victim
When the defensive appliance is compromised, defenders may lose both protection and visibility.
Evooo1Bot Is a Warning About That Exact Scenario
The devices responsible for connecting networks to the internet must themselves be treated as high-value security assets.
The Threat Will Almost Certainly Evolve
If Evooo1Bot continues operating successfully, other malware developers are likely to copy or extend its techniques.
Organizations Should Act Before They See an Infection
Waiting for evidence of compromise is a dangerous strategy when vulnerable edge devices can be discovered automatically.
The Defensive Priority Is Simple
Patch exposed systems, remove unnecessary internet access, strengthen authentication, monitor edge-device traffic, and maintain reliable logs.
The Future of IoT Security Will Depend on Visibility
The devices that organizations cannot see clearly are often the devices attackers will target first.
Evooo1Bot Is More Than Another Botnet
It is another sign that the battle for network infrastructure is becoming increasingly sophisticated—and increasingly difficult to ignore.
✅ FortiGuard Identified Evooo1Bot as a Previously Undocumented Linux Botnet
The supplied report attributes the discovery to FortiGuard Labs and describes the malware as previously undocumented.
The malware name is linked to the recurring evooo1 string found within analyzed samples.
✅ The Malware Uses Mirai-Derived DDoS Functionality
The report states that Evooo1Bot borrows its DDoS engine from leaked Mirai source code.
However, its broader functionality means it should not be described as merely another conventional Mirai variant.
✅ The Campaign Was Observed Beginning in July 2026
According to the supplied FortiGuard findings, telemetry associated with the campaign dates back to July 2026.
The reported activity includes exploitation attempts and payload delivery against internet-facing devices.
✅ Multiple Security and Analysis Tools Are Checked
The supplied research specifically identifies GDB, Wireshark, tcpdump, IDA, Ghidra, YARA, and Valgrind among the tools Evooo1Bot checks for.
This supports the conclusion that the malware contains deliberate anti-analysis capabilities.
⚠️ IOC Handling Requires Caution
The reported IP address and loader URL should be treated as threat-intelligence indicators, not as destinations to visit manually.
Defenders should search existing logs and telemetry for the indicators and investigate associated activity through controlled security workflows.
⚠️ A Vulnerable Device Is Not Automatically an Infected Device
The existence of a vulnerability or exposure does not by itself prove compromise.
Incident responders should correlate exploitation attempts with process execution, outbound communication, persistence artifacts, authentication activity, and filesystem changes.
Prediction
(+1) Evooo1Bot-Like Botnets Will Become More Capable
The most likely development is that future Linux IoT botnets will continue moving beyond simple DDoS functionality.
Attackers have strong incentives to combine DDoS, proxy services, credential theft, vulnerability exploitation, persistence, and remote administration into a single platform.
(+1) Edge Devices Will Receive More Attention From Security Teams
As incidents like Evooo1Bot demonstrate the strategic value of routers, firewalls, cameras, and specialized appliances, organizations are likely to invest more heavily in monitoring these systems.
(+1) Behavioral Detection Will Become More Important
Static indicators can become obsolete quickly when attackers change infrastructure or rebuild payloads.
Network behavior, persistence changes, abnormal processes, authentication anomalies, and unexpected outbound communication will become increasingly valuable detection signals.
(-1) Unpatched Internet-Facing Appliances Will Remain an Easy Target
The negative outlook is straightforward: organizations that continue exposing outdated networking products will remain vulnerable to automated exploitation.
The combination of mass scanning, known vulnerabilities, architecture-aware loaders, and persistent malware creates an environment in which attackers can repeatedly return to the same vulnerable devices.
Final Takeaway: The Router on the Wall May Be More Valuable Than You Think
Evooo1Bot represents an important shift in how defenders should think about Linux-based edge malware.
The threat is not simply about generating traffic or knocking websites offline.
It is about ownership of infrastructure.
A compromised router, firewall, camera, or networking appliance can become a persistent component of an attacker’s operation. It can provide a place to hide, a platform for reconnaissance, a proxy for malicious traffic, an avenue for credential theft, and potentially a bridge toward other systems.
The emergence of Evooo1Bot therefore reinforces a lesson the security industry has learned repeatedly: anything connected to the internet can become an endpoint, and anything that becomes an endpoint must be defended like one.
Organizations should audit internet-facing appliances, eliminate unnecessary exposure, patch vulnerable firmware, replace unsupported equipment, enforce strong authentication, restrict administrative interfaces, monitor outbound traffic, centralize logs, and investigate unexpected persistence mechanisms.
Because once an attacker controls the device sitting at the edge of the network, the boundary between inside and outside can become dangerously thin.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.quora.com/topic/Technology
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
