A new Linux botnet, dubbed Evooo1Bot, has been observed targeting internet-facing gateway devices since at least July, transforming them into SOCKS5 traffic relay nodes. The modular malware, which is based on the Mirai source code, also possesses capabilities for credential theft, SSH brute-forcing, and launching distributed denial-of-service (DDoS) attacks.
Researchers have identified that Evooo1Bot targets devices from several manufacturers, including Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link, by exploiting known vulnerabilities. The botnet's geographical spread is currently under analysis.
While Evooo1Bot reuses Mirai's DDoS engine, it significantly expands upon the original framework. Its enhanced features include encrypted command-and-control (C2) communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal. These exploits target a range of known vulnerabilities in various products.
Newer builds of the malware incorporate a separate vulnerability-exploitation module designed to target Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installations. However, some of these embedded exploits are reportedly not correctly implemented, leading to failed exploitation attempts.
Upon successful exploitation, a script downloads one of 12 malware builds tailored to the host's CPU architecture, then clears Bash history to remove traces of the attack. Evooo1Bot utilizes encrypted C2 communications over port 443 and conducts extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots before executing on an infected device.
Persistence is established through various methods, including systemd, SysV init, shell profiles, and rc.local. A cron job is also set up to attempt re-downloading the payload every five minutes. The malware provides operators with an interactive shell for direct control over compromised systems and supports file transfers.
The credential sniffer module monitors `/proc/net/tcp` to capture HTTP Basic Authentication and Cookie headers. The SOCKS5 module supports both direct listening and reverse-relay modes, enabling attackers to mask malicious traffic, bypass geographic restrictions, or potentially gain access to internal networks via compromised systems. Proxying sessions run independently, and multiple can be opened concurrently, which could allow for monetization through residential proxy services if the botnet expands.
The SSH scanner module employs 150 username and password combinations, primarily targeting enterprise accounts, and includes post-login checks to avoid honeypots. The DDoS module, inherited from Mirai, supports 16 flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and an HTTP flood with customizable requests.
To mitigate the risk of botnet infection, users are advised to keep IoT device firmware updated, replace default administrative credentials, disable remote access panels, and replace devices when vendor support for them ceases.
