MEDIUM Malware #DDoS #Credential Theft #Mirai

Evooo1Bot Linux Botnet Turns Routers Into SOCKS5 Relays

2026-08-15 16:14 UTC 3 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: internet-facing gateway devices and routers are being compromised and turned into SOCKS5 traffic relay nodes.
Affected systems: devices from manufacturers including Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, Hikvision, Zyxel, and TP-Link.
Remediation: keep firmware updated, replace default administrator credentials, and disable unnecessary remote access panels on all network gateway devices.

A newly discovered modular Linux botnet named Evooo1Bot is actively targeting internet-facing gateway devices and routers to weaponize them into SOCKS5 traffic relay nodes. According to BleepingComputer, researchers at Fortinet uncovered the malware, which has been operational since at least July. While the threat actor leverages the distributed denial-of-service engine from the publicly leaked Mirai source code, the malware introduces a significantly expanded capability set designed for persistence, credential harvesting, and traffic proxying.

Technical Analysis of Evooo1Bot

Evooo1Bot extends traditional internet-of-things malware frameworks by incorporating an integrated exploit arsenal, encrypted command-and-control communications over port 443, and extensive defense-evasion checks. Before executing on a newly compromised host, the malware scans for debuggers, security tooling, sandboxes, virtual machines, containers, and honeypots.

Core Modules and Capabilities

Once initial access is secured by exploiting known vulnerabilities across various vendor hardware, a script downloads one of twelve architecture-specific builds and clears the Bash history to remove forensic artifacts. Persistence is established through systemd, SysV init, shell profiles, and rc.local entries, backed by a cron job that attempts payload recovery every five minutes.

SOCKS5 Relay Module: Supports direct listening and reverse-relay modes, allowing operators to route malicious traffic through residential connections and monetize the infrastructure.
Credential Sniffer: Monitors /proc/net/tcp to intercept HTTP Basic Authentication and Cookie headers from local traffic.
SSH Brute-Force Scanner: Utilizes a wordlist of 150 enterprise-oriented credential combinations alongside post-login checks to avoid honeypots.
Vulnerability Exploitation Arsenal: Newer builds target Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link Network Attached Storage devices, WSO2 products, Kubernetes ingress-nginx instances, and vulnerable PHP-CGI installations.
Distributed Denial-of-Service Engine: Inherits 16 distinct flood methods from Mirai, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and customizable HTTP floods.

Actionable Defense and Mitigation Strategies

Defenders managing internet-facing gateway devices and enterprise edge equipment should prioritize specific hardening steps to prevent router compromise and botnet enrollment. Because Evooo1Bot relies on known vulnerabilities and default configurations, administrative hygiene significantly reduces exposure.

Update device firmware immediately to patch known vulnerabilities targeted by automated exploit scanners.
Replace all default administrator credentials with strong, unique passphrases to stop automated brute-force attempts.
Disable remote management panels on public-facing network interfaces unless strictly necessary, restricting administrative access to trusted internal management subnets.
Decommission and replace network hardware that has reached end-of-life status and no longer receives vendor security updates.

#DDoS #Credential Theft #Mirai

X/Twitter LinkedIn Reddit HN

← Back to Articles