A new Mirai-based botnet, dubbed Evooo1Bot, has been observed targeting Linux-based routers and IoT devices since July 2026. The botnet, disclosed by Fortinet's FortiGuard Labs in mid-August, is designed for distributed denial-of-service (DDoS) attacks, credential theft, and establishing criminal proxy services.
Evooo1Bot incorporates the DDoS engine from the publicly leaked Mirai source code but significantly expands its capabilities. Key enhancements include encrypted command-and-control (C2) communications, an SSH brute-force scanner, a credential sniffer, and a SOCKS5 proxy module. The botnet also features an integrated exploit arsenal targeting 18 known vulnerabilities, some dating back to 2007.
The targeted vulnerabilities include CVE-2007-3010 (Alcatel OmniPCX Enterprise), CVE-2016-6277 (NETGEAR Multiple Routers), CVE-2018-14558 (Tenda AC7, AC9, AC10 Routers), CVE-2019-14931 (Mitsubishi Electric Europe B.V. ME-RTU and INEA ME-RTU devices), CVE-2020-10987 (Tenda AC1900 Router AC15 Model), CVE-2021-46422 (Telesquare SDT-CW3B1), CVE-2022-37055 (D-Link Routers), CVE-2024-29269 (Telesquare TLR-2005KSH), CVE-2025-10123 (D-Link DIR-823X), and CVE-2025-55583 (D-Link DIR-868L B1 router). This broad targeting suggests an opportunistic approach by the operators, scanning for any unpatched devices.
Initial access is gained either through exploiting one of these vulnerabilities or via brute-forcing SSH credentials. Upon successful compromise, the bot executes a loader script that clears the Bash history to remove forensic evidence before downloading an architecture-appropriate binary from an external server.
A distinguishing feature of Evooo1Bot is its SOCKS5 proxy module. This module allows compromised devices to act as network relays, enabling attackers to obscure their traffic, bypass geographic restrictions, or gain access to internal networks. The module supports two modes: a direct mode, which opens a SOCKS5 listener on the infected host (default TCP port 1080), and a reverse relay mode, where the bot establishes an outbound encrypted connection to an operator-specified relay server. This functionality can be used by the operators themselves or monetized by selling access to other criminals.
The botnet communicates exclusively over port 443, a deliberate choice to blend malicious traffic with legitimate HTTPS flows at network perimeters. Beyond the proxy capabilities, Evooo1Bot includes a credential sniffer that intercepts HTTP Basic Auth and Cookie headers in transit, allowing operators to capture authentication credentials without additional effort.
The C2 communication is encrypted using AES-256-CTR, ChaCha20, and XOR-based key derivation, and the malware employs multiple layers of string obfuscation. The botnet also features a comprehensive 28-command remote administration interface, supporting file upload and download, interactive shell access, persistence installation, binary updates, and various DDoS attack types (DNS, TCP, UDP, HTTP exploit dispatcher).
The advanced capabilities of Evooo1Bot, particularly its encrypted C2 communications, sophisticated obfuscation, and integrated proxy module, elevate it beyond the typical technical baseline of Mirai-derived malware. Organizations are advised to patch devices against the listed CVEs and ensure that edge hardware does not use default SSH credentials to mitigate the risk of compromise.
