Evooo1Bot Linux Botnet Combines Mirai DDoS Code With Exploits and SOCKS Relays

Summary

Fortinet researchers detail Evooo1Bot, a Linux botnet exploiting vulnerabilities in internet-facing devices. It combines Mirai-derived DDoS, SSH brute forcing, credential sniffing, persistence, and SOCKS proxy capabilities.

Key points

• Fortinet telemetry observed the botnet targeting internet-facing devices since July 2026, using multiple known vulnerabilities across edge devices and enterprise products.
• The malware downloads CPU-specific binaries through a loader, establishes encrypted C2 communications over port 443, and uses anti-analysis checks.
• Its capabilities include SSH brute forcing with more than 150 credentials, HTTP credential and cookie sniffing, file transfer, remote shell access, and 16 DDoS methods.
• A reverse SOCKS relay can route attacker traffic through compromised systems, potentially masking its origin or enabling access to internal networks.
• Persistence methods include systemd, SysV init, cron, shell profiles, and rc.local; the malware also supports self-updating.
• Fortinet says its antivirus detects the malware and its security services block associated infrastructure; it recommends patching exposed devices and monitoring suspicious outbound connections.

Indicators of compromise

MITRE ATT&CK

CVE

People

Malware

Vendors

Products

Related Articles

• Fortinet Details Evooo1Bot, a Modular Linux Botnet Targeting Internet-Facing DevicesCVE-2007-3010 · CVE-2016-6277 · CVE-2018-14558
• ClingSTUN Linux Backdoor Abuses Public STUN Services to Control Compromised IoT DevicesCVE-2022-37055 · CVE-2023-1389 · CVE-2024-10914
• Huntress Details React2Shell Exploitation and Linux MalwareLinux · T1053.003 · T1059.004
• Gambling Goblin Uses Compromised Brazilian Government Sites for SEO Phishing CampaignLinux · T1053.003 · T1059.004
• PCPJack Used 230 Cloud Linux Servers in a Hidden SMTP Relay NetworkLinux · T1053.003 · T1059.004