Essential Insights
- The Evooo1Bot Linux botnet leverages Mirai code, using known vulnerabilities (e.g., CVE-2021-46422, CVE-2025-55583) to infect internet-facing devices and establish encrypted C2 communication for remote control.
- It can turn compromised devices into SOCKS proxies, enabling malicious traffic masking, evading detection, and facilitating follow-on cyber operations, including DDoS attacks and network exploitation.
- The malware features an exploit arsenal targeting multiple critical vulnerabilities across devices like routers, IP cameras, and enterprise systems, increasing attack surface and persistence potential.
Threat Overview, Attack Techniques, and Targets
Cybersecurity researchers have found a new Linux botnet named Evooo1Bot. It is based on the Mirai botnet code and adds new features. The malware uses known flaws to infect internet-facing devices. Once infected, these devices are converted into SOCKS5 proxies. The botnet has been active since July 2026. It exploits multiple vulnerabilities, such as CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, and others. Successful attacks involve running a shell script from an external server, which installs the botnet binary. The malware checks if the device is under analysis and then communicates through port 443. Commands from the command-and-control (C2) server let attackers install persistence, update malware, or launch DDoS attacks. They can also turn infected devices into relays, scanning for SSH brute-force attacks and exploiting vulnerabilities to maintain control. The targets mainly include edge devices like routers, firewalls, and IP cameras that are accessible from the internet.
Impact, Security Implications, and Remediation Guidance
The Evooo1Bot malware can cause significant harm because it turns devices into proxies. These infected devices can be used to hide malicious traffic, bypass security controls, or gain access to sensitive networks. The threat can lead to data theft, disruption of services, and increased difficulty in tracking malicious activity. The malware’s ability to craft encrypted communication and perform multiple commands makes detection challenging. Also, turning devices into proxies helps attackers evade detection and conduct anonymous operations. Because the malware exploits known vulnerabilities, patching these flaws is critical. If your devices are vulnerable, updating firmware and applying security patches can stop infections. Infection also involves deleting traces by clearing Bash history. Security teams should review their device configurations and monitor for unusual traffic patterns. If your devices or network are affected, consult the vendor or relevant authority for specific remediation steps.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
