Evooo1Bot: Mirai-Based Linux Botnet Turns Edge Devices Into SOCKS5 Proxies

Summary

Evooo1Bot is a previously undocumented Linux botnet that expands the capabilities of the Mirai malware ecosystem by combining distributed denial-of-service (DDoS) functionality with encrypted command-and-control (C2) communications, SSH brute-force attacks, credential interception, vulnerability exploitation, and SOCKS5 proxying.

The botnet has been active in the wild since at least July 2026, targeting publicly accessible routers, firewalls, IP cameras, and other Linux-based edge devices through multiple known vulnerabilities. Successful exploitation downloads a shell-based loader that deploys an architecture-compatible Evooo1Bot binary.

Once compromised, devices can be remotely controlled, used for DDoS attacks, leveraged to attack additional systems, or converted into SOCKS5 proxy nodes that conceal malicious traffic behind legitimate victim IP addresses. The combination of vulnerability exploitation, credential attacks, remote administration, and proxy functionality makes compromised edge devices considerably more valuable to attackers than conventional Mirai-style DDoS bots.

Background of Evooo1Bot

Evooo1Bot is a Linux-based botnet identified by Fortinet FortiGuard Labs that derives its core DDoS functionality from the publicly leaked Mirai source code.

Unlike traditional Mirai variants that primarily recruit vulnerable Internet of Things (IoT) devices for denial-of-service attacks, Evooo1Bot extends the original framework with a broader set of post-compromise capabilities. The malware incorporates encrypted C2 communication, an SSH brute-force scanner, a SOCKS relay module, credential-sniffing functionality, remote shell access, file transfer capabilities, persistence mechanisms, and an integrated exploit framework targeting multiple known vulnerabilities.

Evooo1Bot can also intercept HTTP Basic Authorization and Cookie headers, potentially exposing authentication information and active web sessions. This creates additional risks when the compromised device occupies a strategically important position within a network.

One of Evooo1Bot's most significant capabilities is its ability to transform compromised routers, firewalls, IP cameras, and other edge systems into SOCKS5 proxies. Threat actors can subsequently route malicious traffic through victim devices, disguising the true source of attacks behind legitimate residential or enterprise IP addresses.

At scale, these infected devices could provide attackers with a geographically distributed proxy infrastructure while simultaneously supporting DDoS attacks, vulnerability exploitation, SSH scanning, and other malicious operations.

Vulnerability Details

Attack Methodology

• Phase 1: Internet-Facing Device Discovery and Exploitation
  Evooo1Bot targets publicly accessible routers, cameras, networking equipment, and other edge devices affected by known vulnerabilities. The botnet exploits flaws including CVE-2016-6277, CVE-2018-14558, CVE-2020-10987, and CVE-2024-29269 to obtain remote command execution on vulnerable systems.
• Phase 2: Loader Execution and Malware Deployment
  Successful exploitation executes a shell-based loader named wget.sh, observed being hosted on attacker-controlled infrastructure at 91.92.40[.]118. The loader determines the CPU architecture of the compromised device and retrieves a compatible Evooo1Bot binary. After deployment, the script clears Bash history in an attempt to remove traces of commands executed during the infection process.
• Phase 3: Anti-Analysis and Command-and-Control Communication
  After execution, Evooo1Bot performs checks for analysis tools, virtual machines, and sandbox environments. These checks can help the malware determine whether it is executing on a genuine compromised system or inside a security research environment. Evooo1Bot then establishes encrypted communication with its command-and-control infrastructure over TCP port 443. The infected system registers with the C2 server and waits for additional operator instructions.
• Phase 4: Remote Administration and Credential Collection
  Evooo1Bot provides operators with extensive control over compromised systems. Available functionality includes persistence installation, malware updates, interactive shell access, file uploads and downloads, proxy activation, and bot termination. The malware can also intercept HTTP Basic Authorization and Cookie headers, potentially exposing credentials or active session information observable from the compromised device.
• Phase 5: SSH Scanning and Vulnerability Exploitation
  Evooo1Bot contains an SSH brute-force scanner and an HTTP-based exploit dispatcher capable of targeting additional systems. Its exploit framework contains functionality associated with vulnerabilities affecting Hikvision, Atlassian Confluence, WSO2, Zyxel, TP-Link, PHP-CGI, D-Link, and Kubernetes ingress-nginx.
• Phase 6: SOCKS5 Proxying and DDoS Operations
  Compromised devices can be transformed into SOCKS5 proxy nodes, enabling attackers to relay traffic through legitimate victim IP addresses. This can obscure the origin of malicious activity and provide attackers with distributed proxy infrastructure. Evooo1Bot also retains Mirai-derived DDoS functionality and can launch DNS, TCP, and UDP denial-of-service attacks.

Indicators of Compromise (IOCs)

Malicious Infrastructure

• 91.92.40[.]118
• wget.sh

MITRE ATTACK Mapping

Visual Attack Flow

Mitigation

1. Patch vulnerable internet-facing devices immediately.
   Identify and remediate affected routers, firewalls, cameras, application servers, and other edge systems, prioritizing known vulnerabilities associated with Evooo1Bot. Apply the latest vendor firmware and security updates and replace end-of-life devices that no longer receive security patches.
2. Reduce unnecessary internet exposure.
   Avoid exposing administrative interfaces, SSH, Telnet, and device-management services directly to the internet. Restrict administrative access using VPNs, firewall rules, trusted management networks, and source IP allowlisting.
3. Strengthen SSH security.
   Disable password-based SSH authentication where possible and use public-key authentication. Disable direct root login, remove default credentials, enforce strong authentication policies, and monitor repeated failed SSH login attempts that could indicate brute-force activity.
4. Monitor outbound C2 and proxy activity.
   Inspect unexpected outbound connections from routers, firewalls, cameras, and Linux-based edge systems, particularly persistent connections over TCP/443 to unknown infrastructure. Monitor unusual proxy behavior and traffic patterns that could indicate an edge device is being used as a SOCKS5 relay.
5. Hunt for IOCs and suspicious edge-device activity.
   Search firewall, DNS, proxy, IDS/IPS, and network telemetry for connections involving 91.92.40[.]118, execution or retrieval of wget.sh, unexplained shell commands, Bash history deletion, unexpected outbound connections, and abnormal DNS, TCP, or UDP traffic originating from edge devices.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.