Researchers have identified a new Linux botnet, dubbed "Evooo1Bot," which has been actively targeting internet-facing edge devices since July 2026. The botnet, named for the "evooo1" string embedded in its binaries, is a sophisticated variant of the Mirai malware, incorporating enhanced capabilities beyond the original framework's DDoS engine.
Evooo1Bot employs encrypted command-and-control (C2) communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal. Its operators appear to track infection success per vulnerability, using campaign labels embedded in download commands.
The botnet came to light through intrusion prevention system (IPS) telemetry, which observed active exploitation attempts. All payload callbacks pointed to a single loader URL, 91.92.40[.]118/wget.sh. This loader script downloads and executes a botnet binary tailored to the host's CPU architecture, using `wget`, `busybox wget`, `curl`, or `tftp`. Post-infection, the script clears bash history.
Evooo1Bot targets a wide range of vulnerabilities, including: CVE-2007-3010: Alcatel OmniPCX Enterprise Remote Code Execution CVE-2016-6277: NETGEAR Multiple Routers Remote Code Execution CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection CVE-2019-14931: Mitsubishi Electric Europe B.V. ME-RTU and INEA ME-RTU devices Remote Command Injection CVE-2020-10987: Tenda AC1900 Router AC15 Model Remote Code Execution CVE-2021-46422: Telesquare SDT-CW3B1 Command Injection CVE-2022-37055: D-Link Routers Buffer Overflow CVE-2024-29269: Telesquare TLR-2005KSH Command Injection CVE-2025-10123: D-Link DIR-823X Command Injection CVE-2025-55583: D-Link DIR-868L B1 router Command Injection
The malware employs multi-layer encryption for its static strings, using AES and ChaCha20 keys that are split into 32-byte constants and XORed at runtime. An additional XOR decoding procedure is applied to a subset of strings in the .rodata section.
Before proceeding with its operations, Evooo1Bot performs extensive checks for analysis tooling, running processes, sandbox services, and virtual machine/container environment fingerprints. This includes looking for debuggers, disassemblers, network sniffers, and various security and analysis tools. If these checks pass, it establishes a C2 connection on port 443, chosen to mimic legitimate HTTPS traffic.
Evooo1Bot's modular architecture includes several functional components. The `!persist` command installs multiple persistence mechanisms: a systemd service, a SysV init script, a cron job scheduled every five minutes, shell profile injection, and appending to `/etc/rc.local`. To resist termination, the binary reduces its OOM-killer priority and keeps `/dev/watchdog` open.
The `!socks` module transforms an infected host into a SOCKS5 proxy, allowing operators to relay arbitrary TCP traffic. This module supports both direct mode, opening a SOCKS5 listener on TCP port 1080, and reverse mode, where the bot connects back to a specified C2 server. The `!socksauth` command enables optional authentication for the SOCKS proxy.
The `!ssh` module includes a built-in SSH client and a credential dictionary of 150 entries for brute-force attacks. The `!sniff` module reads `/proc/net/tcp` to intercept HTTP Basic Authorization and Cookie headers, logging them to `/tmp/.sniff.log`. The `!cve` module acts as an HTTP-based exploit dispatcher, allowing operators to supply a payload host and launch concurrent sweeps with the `MODE:all` option.
The botnet also features standard botnet functionalities such as `!download` and `!upload` for file transfers (with a 10 MB download limit), `!shell` for interactive shell access, `!reinstall` for self-updates, and `!kill`, `!exit`, and `!info` for bot control. Its DDoS module supports 16 different flood methods. Earlier builds of the botnet supported all commands except `!cve`, `!stopcve`, and `!cveall`.
