Since at least July, **Evooo1Bot** has been observed exploiting known vulnerabilities in devices from manufacturers such as **Alcatel**, **NETGEAR**, **Tenda**, **Mitsubishi Electric**, **Telesquare**, and **D-Link** across various geographical regions. ### Expanding Beyond Mirai's Foundations Researchers at **Fortinet** highlighted **Evooo1Bot**'s advanced design, noting that while it reuses **Mirai**'s DDoS engine, it significantly expands the original framework. "While the malware reuses the DDoS engine from the publicly leaked **Mirai** source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities," **Fortinet** researchers found. .jpg) *Source: Fortinet* Newer builds of **Evooo1Bot** incorporate a dedicated vulnerability-exploitation module. This module targets a broad spectrum of devices and software, including **Hikvision** cameras, **Atlassian Confluence**, **Zyxel** firewalls, **TP-Link** routers, **D-Link** NAS devices, **WSO2** products, **Kubernetes ingress-nginx**, and vulnerable **PHP-CGI** installations. However, **Fortinet** also noted that some of the embedded exploits are not perfectly implemented, occasionally leading to failed exploitation attempts. ### Stealth and Persistence Mechanisms Upon successful exploitation, a script downloads one of 12 available malware builds, tailored to the host's CPU architecture. It then clears the Bash history to erase traces of the intrusion. **Evooo1Bot** employs encrypted command-and-control (C2) communications over port 443 and conducts extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots before executing on the infected device. This pre-execution check helps the botnet evade detection and analysis. Persistence is established through various methods, including `systemd`, `SysV init`, shell profiles, and `rc.local`. A `cron` job further ensures the payload is re-downloaded every five minutes, maintaining its presence on compromised systems.  *Source: Fortinet* ### Multifunctional Modules for Attackers The malware provides operators with an interactive shell for direct control over compromised systems, alongside file-transfer capabilities for uploading and downloading data. A dedicated credential sniffer module monitors `/proc/net/tcp` to capture HTTP Basic Authentication and Cookie headers. The SOCKS5 module is particularly notable, supporting both direct listening and reverse-relay modes. This functionality allows attackers to obfuscate malicious traffic, bypass geographic restrictions, and potentially gain access to internal networks through compromised systems. **Fortinet** suggests that if the botnet expands significantly, these proxying capabilities could be monetized through residential proxy services. The SSH scanner module attempts to brute-force access using a list of 150 username and password combinations, primarily targeting enterprise-oriented accounts, and includes post-login checks to avoid honeypots. Finally, the inherited **Mirai** DDoS module supports 16 different flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and customizable HTTP floods. ### Defense Strategies for IT Professionals and Users To mitigate the risk of falling victim to **Evooo1Bot** and similar botnet malware, users and IT security professionals should adhere to fundamental cybersecurity best practices: * Keep IoT device firmware consistently updated. * Replace default administrator credentials with strong, unique passwords. * Disable remote access panels when not essential. * Replace end-of-life devices for which vendors no longer provide security updates or support.