Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies.
“While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities,” Fortinet FortiGuard Labs said.
Evidence indicates that the botnet has been active in the wild since July 2026, exploiting known vulnerabilities in publicly-accessible devices to deliver the malware. Some of the security flaws weaponized by the botnet are below –
- CVE-2007-3010 – Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
- CVE-2016-6277 – NETGEAR Multiple Routers Remote Code Execution Vulnerability
- CVE-2018-14558 – Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
- CVE-2019-14931 – Mitsubishi Electric Europe B.V. ME-RTU devices and INEA ME-RTU devices remote Command Injection vulnerability
- CVE-2020-10987 – Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
- CVE-2021-46422 – Telesquare SDT-CW3B1 Command Injection vulnerability
- CVE-2022-37055 – D-Link Routers Buffer Overflow Vulnerability
- CVE-2024-29269 – Telesquare TLR-2005KSH Command Injection Vulnerability
- CVE-2025-10123 – D-Link DIR-823X Command Injection Vulnerability
- CVE-2025-55583 – D-Link DIR-868L B1 router Command Injection Vulnerability
Successful exploitation leads to the execution of a loader shell script (“wget.sh”) hosted on an external server (“91.92.40[.]118”), which then retrieves the botnet binary that’s compatible with the device CPU architecture. The script subsequently clears Bash history to erase traces of the attack.
Upon execution, the binary checks for the presence of analysis tools, sandboxes, and virtual environments, before establishing encrypted communications with a command-and-control (C2) server on port 443. The port choice is intentional as it allows the malware to blend in with expected HTTPS traffic at the network perimeter. Once the host is registered with the C2 server, it waits for further commands to take action.
It supports a number of commands that allow an operator to install persistence mechanisms, update the binary, terminate the bot, upload/download files, launch an interactive shell, intercept HTTP Basic Authorization and Cookie headers, turn the host into a proxy node, launch an SSH brute-force scanner, trigger DDoS attacks over DNS, TCP, and UDP, and fire an HTTP-based exploit dispatcher for exploiting known flaws.
The CVE attack module includes the ability to launch exploits for eight security flaws impacting Hikvision (CVE-2021-36260), Atlassian Confluence (CVE-2022-26134), WSO2 (CVE-2022-29464), Zyxel (CVE-2022-30525), TP-Link (CVE-2023-1389), PHP (CVE-2024-4577), D-Link (CVE-2024-10914), Kubernetes (CVE-2025-1974).
The proxy component, on the other hand, transforms an infected router, firewall, IP camera, or other edge device into a SOCKS5 proxy that the threat actor can leverage as a network relay to conduct follow-on operations and evade detection.
“This capability significantly increases the value of an infected host to attackers,” Fortinet said. “The victim’s IP address can be used to disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine.”
“In larger botnets, the same functionality could also be used to build a distributed proxy infrastructure, enabling anonymous traffic forwarding or monetization through residential and enterprise proxy services.”
