Cybersecurity researchers at **Fortinet FortiGuard Labs** have identified a previously undocumented Linux botnet family dubbed **Evooo1Bot**. This new threat derives its core functionality from the publicly leaked **Mirai** botnet source code but significantly extends its capabilities. "While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities," **Fortinet FortiGuard Labs** stated in their analysis. Evidence suggests the botnet has been active since July 2026, exploiting known vulnerabilities in publicly accessible devices to deliver its malicious payload. The botnet targets a wide range of older, unpatched vulnerabilities, highlighting the ongoing risk of legacy systems. ### Exploited Vulnerabilities Some of the security flaws weaponized by **Evooo1Bot** include: * **CVE-2007-3010** - **Alcatel OmniPCX Enterprise** Remote Code Execution Vulnerability * **CVE-2016-6277** - **NETGEAR** Multiple Routers Remote Code Execution Vulnerability * **CVE-2018-14558** - **Tenda AC7**, **AC9**, and **AC10** Routers Command Injection Vulnerability * **CVE-2019-14931** - **Mitsubishi Electric Europe B.V. ME-RTU** devices and **INEA ME-RTU** devices remote Command Injection vulnerability * **CVE-2020-10987** - **Tenda AC1900 Router AC15 Model** Remote Code Execution Vulnerability * **CVE-2021-46422** - **Telesquare SDT-CW3B1** Command Injection vulnerability * **CVE-2022-37055** - **D-Link Routers** Buffer Overflow Vulnerability * **CVE-2024-29269** - **Telesquare TLR-2005KSH** Command Injection Vulnerability * **CVE-2025-10123** - **D-Link DIR-823X** Command Injection Vulnerability * **CVE-2025-55583** - **D-Link DIR-868L B1 router** Command Injection Vulnerability ### Infection Chain and Modus Operandi Successful exploitation leads to the execution of a loader shell script, `wget.sh`, hosted on an external server (91.92.40[.]118). This script then retrieves the botnet binary compatible with the device's CPU architecture. To evade detection, the script subsequently clears the Bash history, removing traces of the initial attack. Upon execution, the **Evooo1Bot** binary performs checks for analysis tools, sandboxes, and virtual environments. It then establishes encrypted communications with a command-and-control (C2) server over port 443. The use of port 443 is a deliberate tactic to blend malicious traffic with legitimate HTTPS traffic, making it harder to detect at the network perimeter. Once the compromised host registers with the C2 server, it awaits further commands.  ### Advanced Capabilities and Proxy Functionality **Evooo1Bot** supports a wide array of commands, enabling operators to: * Install persistence mechanisms * Update the binary * Terminate the bot * Upload and download files * Launch an interactive shell * Intercept HTTP Basic Authorization and Cookie headers * Transform the host into a proxy node * Launch an SSH brute-force scanner * Trigger DDoS attacks over DNS, TCP, and UDP * Execute an HTTP-based exploit dispatcher for known flaws The botnet's CVE attack module includes exploits for eight additional security flaws, impacting products from **Hikvision** (**CVE-2021-36260**), **Atlassian Confluence** (**CVE-2022-26134**), **WSO2** (**CVE-2022-29464**), **Zyxel** (**CVE-2022-30525**), **TP-Link** (**CVE-2023-1389**), **PHP** (**CVE-2024-4577**), **D-Link** (**CVE-2024-10914**), and **Kubernetes** (**CVE-2025-1974**). Crucially, the proxy component transforms an infected router, firewall, IP camera, or other edge device into a **SOCKS5** proxy. This allows threat actors to leverage the compromised device as a network relay for follow-on operations and to evade detection. "This capability significantly increases the value of an infected host to attackers," **Fortinet** highlighted. "The victim's IP address can be used to disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine." In larger botnets, this functionality could also be used to construct a distributed proxy infrastructure, facilitating anonymous traffic forwarding or even monetizing compromised residential and enterprise proxy services.  ### Implications for IT Security Professionals The emergence of **Evooo1Bot** underscores the persistent threat posed by botnets that evolve from established malware families. The focus on older vulnerabilities affecting a wide range of internet-facing devices, coupled with advanced proxy capabilities, makes this botnet particularly dangerous. Organizations must prioritize patching known vulnerabilities, especially those impacting edge devices and embedded systems, to mitigate the risk of compromise. Network monitoring for unusual traffic patterns, particularly over common ports like 443 that might mask C2 communications, is also crucial.