Listen to this Post
A Quiet Linux Threat With a Dangerous New Business Model
Linux botnets have never really disappeared. They have simply become more adaptable, more modular, and increasingly valuable to the criminals operating them. The latest example is Evooo1Bot, a previously undocumented Linux malware family that FortiGuard Labs says has been active since July 2026.
What makes Evooo1Bot particularly concerning is not just its ability to launch distributed denial-of-service attacks. The malware reportedly combines the familiar DDoS machinery of Mirai with encrypted command-and-control communications, SSH brute-force capabilities, credential interception, vulnerability exploitation, and a SOCKS5 proxy system.
That last capability changes the equation.
An infected router, camera, firewall, server, or other Linux-based edge device is no longer merely another soldier in a DDoS army. It can become a network relay, allowing criminals to route traffic through the victim’s legitimate IP address and potentially hide where their activity really originated.
FortiGuard Labs describes Evooo1Bot as significantly more capable than conventional Mirai-derived malware. Fortinet’s broader 2026 threat research has also warned that automated exploitation is shrinking the window defenders have to patch vulnerable systems.
Fortinet
+1
From Mirai to a More Versatile Botnet
The most recognizable part of Evooo1Bot is its relationship with Mirai.
Mirai became infamous for turning poorly secured internet-connected devices into enormous DDoS armies. Its source code was publicly leaked, and criminals have repeatedly modified that code into new botnet families.
Evooo1Bot follows the same evolutionary path, but it adds considerably more functionality around the original DDoS engine.
According to the report described in the original article, the malware incorporates encrypted C2 communications, an SSH brute-force scanner, a credential sniffer, a SOCKS5 relay, vulnerability exploitation capabilities, remote shell access, file transfer functions, persistence mechanisms, and DDoS functionality.
The result is not simply another Mirai clone.
It is closer to a modular remote-access platform built on top of a familiar botnet foundation.
The Name Hidden Inside the Malware
The name Evooo1Bot reportedly comes from the hardcoded string evooo1, which researchers found inside the malware binaries.
Naming malware after strings embedded within samples is common in threat research because those identifiers can provide useful clues when tracking related samples, campaigns, and infrastructure.
In this case, the identifier also helps distinguish Evooo1Bot from the many other Mirai-derived families that have appeared over the years.
Active Since July 2026
FortiGuard Labs reportedly observed the previously undocumented botnet beginning in July 2026.
That timing matters because the campaign appears designed around a familiar reality of modern internet security: enormous numbers of devices remain exposed long after vulnerabilities have been publicly disclosed.
Fortinet’s 2026 threat landscape research describes a broader environment in which attackers are exploiting vulnerabilities at increasingly high speed, while automation allows criminals to scan and attack systems at enormous scale.
Fortinet
Evooo1Bot fits neatly into that model.
Rather than spending significant effort selecting individual victims, the malware appears designed to search broadly for devices that are simply vulnerable enough to compromise.
An Arsenal of Known Vulnerabilities
The malware reportedly contains exploit modules targeting 18 known CVEs.
Some of the vulnerabilities are reportedly very old, including flaws dating back as far as 2007.
That detail is one of the most important lessons from the entire story.
Old vulnerabilities remain useful when organizations fail to patch, replace, or properly isolate vulnerable systems. A vulnerability does not become harmless simply because it is old.
In fact, old vulnerabilities can become particularly attractive to automated malware because exploit techniques may already be publicly documented, tested, and incorporated into existing attack tools.
Why Attackers Prefer Port 443
Evooo1Bot reportedly communicates over TCP port 443.
That is not a random choice.
Port 443 is overwhelmingly associated with HTTPS traffic, meaning connections to it are common across modern networks.
Using a familiar port can help malicious traffic blend into legitimate internet activity and may reduce the effectiveness of simplistic firewall rules that block unusual outbound ports.
This does not mean traffic on port 443 is automatically invisible. Proper network monitoring can still identify suspicious destinations, unusual TLS behavior, unexpected beaconing patterns, and communications from devices that should not be communicating externally.
The important point is that attackers understand defenders often trust familiar protocols and ports more than unusual ones.
The Attack Begins With Initial Access
According to the original report, Evooo1Bot can obtain access through its exploit modules or by brute-forcing SSH credentials.
This creates two major defensive problems.
The first is vulnerability management.
The second is identity security.
A device can be fully patched and still be exposed if its SSH service is protected by weak or default credentials. Conversely, strong credentials are not enough if an internet-facing device remains vulnerable to remote exploitation.
The strongest defense therefore requires both patching and proper authentication controls.
Erasing Evidence Before Installation
One particularly notable behavior is the
The purpose is obvious: reduce the amount of evidence left behind.
Attackers have used log and history deletion for years, but its inclusion in an automated botnet highlights how even commodity malware increasingly incorporates techniques associated with more sophisticated intrusions.
A compromised Linux system should therefore never be investigated solely through shell history.
Security teams should examine authentication logs, process activity, network connections, filesystem changes, persistence mechanisms, DNS activity, and external communications.
The SOCKS5 Feature Changes Everything
The most interesting component of Evooo1Bot may be its SOCKS5 proxy functionality.
A normal DDoS botnet wants infected devices primarily for their processing power and network bandwidth.
A proxy-enabled botnet can extract another form of value from them: their network identity.
The
An attacker could potentially route traffic through a compromised device to make malicious activity appear to originate from the victim’s network.
Why Compromised Enterprise IPs Are Valuable
The value of a compromised proxy depends heavily on where it is located.
An IP address belonging to an enterprise network can potentially provide access to services that treat corporate traffic differently from traffic originating from ordinary cloud infrastructure.
A residential IP address can also be valuable because many security systems treat residential traffic differently from data-center traffic.
This creates an underground economy around compromised infrastructure.
Instead of merely launching attacks, criminals can potentially monetize access to infected machines as proxy endpoints.
Direct SOCKS5 Mode
The malware reportedly supports a direct SOCKS5 mode in which an infected machine listens for incoming proxy connections.
The described default listener is TCP port 1080.
The implementation reportedly attempts IPv6 first and falls back to IPv4 when necessary.
From a defensive perspective, an unexpected SOCKS listener on a server, router, camera, or firewall should be treated as suspicious unless the device is intentionally configured to provide proxy services.
Reverse Relay Mode
The second proxy mode is even more interesting.
Instead of opening a listening port that outsiders can connect to, the compromised machine can establish an outbound encrypted connection to a relay controlled by the attacker.
The attacker can then use that persistent channel to request new proxy sessions.
This approach can be particularly useful for bypassing inbound firewall restrictions because the infected device initiates the connection outward.
It also demonstrates why monitoring only incoming connections is no longer sufficient.
The Credential Sniffer
Evooo1Bot reportedly includes a credential-sniffing capability capable of intercepting HTTP authentication headers and cookies.
This is especially dangerous on devices that handle traffic for other systems.
If credentials or session information traverse an infected device in an observable form, malware running on that device may be able to capture them.
Modern encryption dramatically reduces this risk when properly implemented, but legacy services, poorly configured applications, and administrative interfaces can still expose sensitive authentication material.
A 28-Command Remote Administration Interface
The malware reportedly contains a 28-command remote administration interface.
Its capabilities include file uploads and downloads, interactive shell access, persistence installation, binary updates, credential-related interception, DDoS operations, and exploit dispatching.
This is another reason Evooo1Bot should not be viewed as a simple DDoS bot.
The malware provides operators with a broader post-compromise toolkit.
Once an attacker gains control of a vulnerable machine, the machine can potentially be repurposed for multiple objectives.
Encryption and Obfuscation
Evooo1Bot reportedly uses multiple layers of protection to make analysis and detection more difficult.
The original article describes AES-256-CTR, ChaCha20, and XOR-based key derivation among its encryption and obfuscation mechanisms.
This combination illustrates a broader trend in malware development.
Commodity malware increasingly borrows defensive engineering techniques from legitimate software.
Encryption is no longer used only to protect legitimate communications. It is also used by attackers to make command traffic harder to inspect and malicious strings harder to identify through simple signatures.
Why IoT and Edge Devices Are Prime Targets
Linux is everywhere.
It powers servers, routers, cameras, appliances, firewalls, industrial systems, network equipment, storage devices, and countless embedded platforms.
Many of these systems are not managed like ordinary employee computers.
Some receive updates infrequently.
Others are forgotten after deployment.
Some continue running with default configurations for years.
That makes internet-facing Linux infrastructure an attractive target for automated botnets.
The Forgotten Device Problem
Security teams often focus on laptops, desktops, cloud workloads, and identity systems.
But the forgotten camera, router, appliance, firewall, or embedded server sitting at the edge of the network can become the easiest entry point.
Evooo1Bot demonstrates why asset inventories must include devices that are not traditionally considered endpoints.
If a machine can execute code and communicate with the internet, it represents an attack surface.
Why Old CVEs Still Matter
One of the strongest messages from this campaign is the apparent use of old vulnerabilities.
Organizations sometimes assume that attackers are primarily interested in newly disclosed zero-days.
That is not how automated criminal campaigns necessarily work.
If millions of internet-facing devices remain vulnerable to an old flaw, there is little economic incentive for an attacker to ignore them.
Old vulnerabilities can be incredibly profitable when defenders have failed to remove them.
Defensive Commands for Linux Administrators
Check Listening Network Services
Administrators can begin by identifying unexpected listening services:
sudo ss -lntup
Look carefully for unfamiliar processes, especially unexpected proxy services or listeners on systems that should not expose them.
Inspect Active Network Connections
To identify unusual outbound communications:
sudo ss -tunap
Review persistent connections from applications or services that normally have no reason to communicate externally.
Review SSH Authentication Activity
On systems using systemd-based logging:
sudo journalctl -u ssh --since "24 hours ago"
On some distributions, authentication activity can also be reviewed with:
sudo grep -Ei "Failed password|Accepted password|Accepted publickey" /var/log/auth.log
The exact log location varies between Linux distributions.
Check for Unexpected Processes
A basic process review can help identify suspicious activity:
ps aux --sort=-%cpu | head -30
and:
ps aux --sort=-%mem | head -30
These commands do not identify Evooo1Bot specifically, but they can reveal unusual processes consuming CPU or memory.
Search for Suspicious Persistence
Review common cron locations:
sudo crontab -l sudo ls -la /etc/cron.d/ sudo ls -la /etc/cron.daily/
Also inspect systemd services:
systemctl list-unit-files --type=service --state=enabled
Unexpected persistence should be investigated rather than immediately deleted if forensic evidence may be required.
Do Not Rely on Bash History
Why History Alone Is Insufficient
Clearing Bash history is not proof that a system has been compromised, but it can be a useful indicator when combined with other suspicious activity.
Incident responders should preserve relevant logs before making major changes to the machine.
A compromised device should ideally be isolated from the network while investigators determine the scope of the intrusion.
Network-Level Detection
Watch for Unexpected Proxy Behavior
Organizations should monitor for unexpected SOCKS traffic, particularly from devices that have no legitimate reason to act as proxies.
Outbound connections to unfamiliar infrastructure should also be investigated.
Network telemetry can be particularly valuable when malware attempts to hide activity at the endpoint.
Monitor Port 443 Intelligently
Blocking port 443 is obviously not practical.
Instead, defenders should investigate unusual TLS connections, newly observed destinations, unexpected beaconing intervals, suspicious certificate characteristics, and devices that suddenly begin communicating with external infrastructure.
Encrypted traffic still generates metadata.
That metadata can become a valuable detection source.
What Undercode Say:
The Real Threat Is the Combination
Evooo1Bot is concerning because no single capability is particularly revolutionary.
Mirai-style DDoS attacks are old.
SSH brute forcing is old.
Credential theft is old.
SOCKS proxies are old.
Exploitation of unpatched vulnerabilities is old.
The danger comes from putting all of these capabilities into one automated package.
Botnets Are Becoming Infrastructure
The traditional image of a botnet is a collection of infected machines waiting for a DDoS command.
That model is becoming incomplete.
Modern botnets can provide computational resources, bandwidth, credentials, network access, proxy infrastructure, and persistence.
The infected machine becomes an asset that can be reused.
The Proxy Economy Is Especially Important
The SOCKS5 capability may ultimately be more economically valuable than the DDoS functionality.
Attackers can potentially monetize IP addresses and network locations.
That makes the
Edge Devices Are Increasingly Attractive
Routers, cameras, firewalls, and appliances often have long lifespans.
Organizations may replace employee computers every few years while leaving networking equipment deployed for much longer.
That creates an enormous pool of potential targets.
Vulnerability Management Must Include Appliances
A vulnerability-management program that only scans traditional servers and workstations is incomplete.
Internet-facing appliances should be included in asset inventories, patching schedules, vulnerability assessments, and incident-response plans.
Old Vulnerabilities Can Become Weapons Again
The inclusion of older CVEs is a reminder that attackers do not care how embarrassing an old vulnerability is.
If it still works, it still matters.
SSH Is Still a Major Attack Surface
Exposed SSH services remain attractive to automated scanners.
Organizations should eliminate default passwords, disable unnecessary internet-facing SSH access, use strong authentication, restrict administrative access, and monitor failed login attempts.
Encryption Is Not a Sign of Legitimacy
Port 443 and encrypted communications can make malicious traffic harder to inspect.
But encryption does not make a connection legitimate.
Security monitoring must increasingly combine endpoint, DNS, IP reputation, TLS, authentication, and behavioral signals.
Detection Must Move Beyond Signatures
A malware family can change its binary, infrastructure, strings, and encryption.
Behavior is harder to replace.
Unexpected proxy listeners, unusual outbound connections, unauthorized persistence, suspicious shell activity, and unexplained resource consumption can remain valuable indicators.
The Loader Matters
The initial loader is often overlooked.
But its actions can reveal how attackers prepare the system before installing the main payload.
History manipulation, architecture detection, downloading a matching binary, and establishing persistence form a recognizable intrusion sequence.
DDoS Is Only One Monetization Strategy
Criminal operators do not necessarily need to launch attacks themselves.
They can rent access.
They can sell proxies.
They can use compromised systems for credential theft.
They can deploy additional malware.
The infected machine becomes a platform for future activity.
Enterprise IP Addresses Have Value
A compromised enterprise device can provide a network identity that criminals cannot easily obtain from ordinary cloud servers.
This makes enterprise edge devices particularly valuable targets.
Residential and Enterprise Proxies Are Different
Residential IP addresses can help attackers bypass some geographic and reputation restrictions.
Enterprise IP addresses can potentially provide access to trusted network locations.
Both can become valuable commodities.
Compromise Can Outlive the Original Campaign
Even if the original Evooo1Bot operators disappear, the compromised machine may remain vulnerable to another attacker.
Once a device is breached, defenders should not assume that removing one known malware sample automatically restores trust.
Reimaging Can Be Safer Than Cleaning
For high-confidence compromises, rebuilding the device from a known-good image can be safer than attempting to manually remove every malicious component.
The correct response depends on the device and forensic requirements.
Asset Inventory Is a Security Control
You cannot patch a device you do not know exists.
You cannot monitor a service you do not know is exposed.
You cannot investigate a compromised system that is absent from the asset inventory.
Internet Exposure Should Be Minimized
If a management interface does not need to be accessible from the public internet, it should not be.
Reducing exposure removes entire categories of automated attacks.
Authentication Needs Multiple Layers
Strong passwords alone are not enough.
Network restrictions, MFA where supported, key-based authentication, rate limiting, and disabling unnecessary services can dramatically reduce brute-force exposure.
IoT Security Remains a Structural Problem
The industry continues to struggle with devices that are difficult to update, poorly configured, or abandoned by vendors.
Botnets thrive in exactly that environment.
Mirai’s Legacy Continues
The continued appearance of Mirai-derived malware proves that leaked source code can have a very long lifespan.
Attackers do not need to reinvent the fundamentals.
They can keep improving the framework.
Modularity Makes Malware More Durable
A modular malware architecture allows criminals to add new exploits, commands, or monetization capabilities without rebuilding the entire concept.
That makes these families more adaptable.
Automated Exploitation Changes the
Fortinet’s 2026 threat research emphasizes the growing speed of automated exploitation.
Fortinet
That means waiting several weeks to patch an internet-facing vulnerability can be increasingly dangerous.
Security Teams Need Better Prioritization
Not every vulnerability deserves identical urgency.
Internet-facing systems, actively exploited vulnerabilities, exposed management interfaces, and devices with sensitive network positions should receive priority.
Compromised Hosts Should Be Treated as Untrusted
A machine that has been compromised cannot automatically be trusted simply because antivirus software no longer detects the malware.
Investigators need to consider persistence, credentials, scheduled tasks, services, SSH keys, and other possible attacker changes.
Proxy Capabilities Raise Privacy Risks
The SOCKS feature means an infected organization could unknowingly become part of someone else’s malicious traffic chain.
That can create legal, operational, and reputational problems in addition to technical damage.
Network Segmentation Matters
If an edge device is compromised, segmentation can prevent attackers from turning one foothold into broader network access.
Flat networks make botnet infections more dangerous.
Logging Must Be Centralized
If malware can modify local logs or shell history, local evidence can disappear.
Centralized logging can preserve important records outside the compromised machine.
The Best Defense Is Still Basic Security
Patch vulnerable systems.
Remove default credentials.
Disable unnecessary services.
Restrict management interfaces.
Monitor unusual outbound traffic.
Maintain reliable backups.
Keep accurate asset inventories.
None of these recommendations are glamorous.
All of them remain effective.
Evooo1Bot Is a Warning, Not Just a Malware Family
The larger lesson is that cybercriminals are turning compromised devices into multipurpose infrastructure.
A router can become a DDoS weapon.
A camera can become a proxy.
A firewall can become an entry point.
A server can become a credential collection platform.
The Attack Surface Keeps Moving
Organizations can no longer define their security perimeter only around laptops and servers.
The perimeter includes every connected device capable of executing code and communicating externally.
Automation Favors Attackers
A human attacker cannot manually inspect millions of devices.
A botnet can.
That asymmetry is one of the biggest reasons automated vulnerability exploitation remains so effective.
The Next Generation Will Likely Be More Modular
Evooo1Bot’s architecture suggests where commodity malware can go next.
Future botnets may increasingly combine exploitation, credential theft, proxying, DDoS, persistence, and monetization into flexible platforms.
Defenders Need to Think Like Infrastructure Owners
The question is no longer simply, “Is my device infected?”
The better question is, “What could an attacker use this device for if it were compromised?”
That change in thinking can expose risks that traditional antivirus-focused security programs miss.
The Bottom Line
Evooo1Bot is another reminder that the most dangerous malware does not always need a groundbreaking exploit.
Sometimes the winning formula is simple: find old vulnerabilities, automate exploitation, compromise thousands of devices, and give criminals multiple ways to monetize the resulting access.
That is precisely why unpatched Linux infrastructure and poorly secured edge devices remain such attractive targets.
Deep Analysis: How to Investigate a Suspected Linux Botnet Infection
Step 1: Preserve Evidence
If compromise is suspected, avoid immediately rebooting or deleting suspicious files when forensic investigation is required.
Record the system state and isolate the host from unnecessary network communication.
Step 2: Inspect Listening Ports
Run:
sudo ss -lntup
Look for unexpected listeners, especially proxy-related services or processes that should not be exposed.
Step 3: Inspect Established Connections
Run:
sudo ss -tunap
Investigate persistent outbound connections from unfamiliar processes.
Step 4: Examine Processes
Run:
ps auxww
For a quick resource-oriented review:
top
Unexpected binaries running from temporary directories or unusual user-owned locations deserve attention.
Step 5: Review SSH Activity
Use:
sudo journalctl -u ssh --since "24 hours ago"
Search for repeated authentication failures, unexpected successful logins, and unfamiliar source addresses.
Step 6: Inspect Persistence
Review enabled services:
systemctl list-unit-files --type=service --state=enabled
Then examine scheduled tasks:
sudo crontab -l sudo ls -la /etc/cron.d/
Unexpected persistence mechanisms should be investigated carefully.
Step 7: Check Recent File Changes
A useful starting point for recently modified executable files is:
sudo find /usr/local/bin /usr/local/sbin /tmp /var/tmp -type f -mtime -7 -ls 2>/dev/null
This is a hunting technique, not a definitive Evooo1Bot detector.
Step 8: Investigate Authentication Files
Administrators should examine unexpected changes to SSH configuration and authorized keys:
sudo find /root /home -name authorized_keys -type f -ls 2>/dev/null
Unexpected keys can indicate unauthorized persistence.
Step 9: Check Firewall and Network Configuration
Review firewall configuration and routing rules:
sudo iptables -S
On systems using nftables:
sudo nft list ruleset
Unexpected changes may provide additional evidence.
Step 10: Isolate and Rebuild When Necessary
If a device is confirmed compromised and cannot be trusted, isolate it from production networks.
For critical systems, rebuild from a known-good image, rotate credentials that may have been exposed, patch the underlying vulnerabilities, and investigate whether the attacker moved elsewhere.
✅ FortiGuard Labs Is a Legitimate Threat-Intelligence Source
FortiGuard Labs is
Fortinet
+1
✅ Mirai-Derived Linux Botnets Are a Well-Established Threat
The broader claim that modern Linux and IoT botnets continue to reuse concepts and code associated with Mirai is consistent with the established evolution of IoT malware.
✅ SOCKS Proxy Functionality Can Increase the Value of a Compromised Host
A compromised device functioning as a proxy can allow attackers to route traffic through the victim’s IP address, creating additional operational and monetization opportunities.
⚠️ The Exact Evooo1Bot Technical Details Should Be Attributed to the FortiGuard Report
The specific claims concerning the 18 CVEs, 28 commands, encryption algorithms, July 2026 activity, and precise proxy implementation are presented in the supplied article as findings from FortiGuard Labs. I could not independently retrieve a publicly indexed FortiGuard Evooo1Bot report from the available search results, so those details should remain attributed rather than presented as independently verified facts.
⚠️ The Statement That Evooo1Bot Is “Already Scanning You” Is Too Broad
A vulnerable internet-facing Linux device could be exposed to automated scanning, but the available information does not establish that every unpatched device is currently being scanned by Evooo1Bot specifically.
❌ Being Vulnerable Does Not Automatically Mean a Device Is Infected
An unpatched device may be exposed to exploitation attempts without actually being compromised.
Detection requires evidence such as malicious processes, suspicious network connections, unauthorized persistence, altered files, or other indicators of compromise.
Prediction
(+1) Linux Edge Devices Will Remain a Major Botnet Target
As routers, cameras, firewalls, storage systems, and embedded appliances become more connected, attackers will continue targeting them with automated exploitation and credential attacks.
(+1) Proxy Functionality Will Become More Common in Commodity Botnets
The ability to monetize compromised IP addresses gives criminals a strong incentive to add SOCKS and relay capabilities to future malware families.
(+1) Old Vulnerabilities Will Continue Driving Large-Scale Campaigns
Attackers are likely to keep exploiting older CVEs wherever organizations leave vulnerable systems exposed to the public internet.
(+1) Botnets Will Become More Modular
Future Mirai-derived families are likely to combine DDoS, proxying, credential theft, vulnerability exploitation, persistence, and remote administration into increasingly flexible platforms.
(-1) Basic Port Blocking Alone Will Not Stop These Campaigns
Blocking unusual ports will have limited value when malware deliberately communicates through commonly used services such as HTTPS.
(-1) Traditional Signature-Only Detection Will Become Less Reliable
Encryption, obfuscation, rapidly changing binaries, and modular payloads will continue pushing defenders toward behavioral and network-level detection.
(+1) Asset Inventory and Rapid Patching Will Become Even More Important
Organizations that can identify internet-facing devices quickly and patch or isolate them rapidly will have a substantially better chance of preventing automated botnet enrollment.
(+1) Evooo1Bot Highlights a Larger Shift in Cybercrime
The most important story may not be Evooo1Bot itself. It is the direction represented by the malware: compromised devices are increasingly becoming multipurpose criminal infrastructure rather than disposable DDoS nodes.
Fortinet’s broader 2026 research similarly describes an environment where automation is accelerating exploitation and reducing defenders’ reaction time.
Fortinet
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.quora.com/topic/Technology
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
