Fortinet Details Evooo1Bot, a Modular Linux Botnet Targeting Internet-Facing Devices

Aug 13, 2026 · Original article ↗

Summary

FortiGuard Labs analyzes Evooo1Bot, a Linux botnet observed exploiting vulnerabilities in internet-facing devices since July 2026. Its capabilities include DDoS, SSH brute force, credential sniffing, and SOCKS proxying.

Key points

FortiGuard Labs observed Evooo1Bot exploitation attempts against internet-facing edge devices beginning in July 2026, using a shared loader to install architecture-specific binaries.
The botnet targets multiple known vulnerabilities in routers, cameras, network appliances, and enterprise products; some exploit entries are nonfunctional as implemented.
Its modules include a Mirai-derived DDoS engine, an SSH brute-force scanner with more than 150 credentials, a credential sniffer, and remote shell and file-transfer functions.
A SOCKS5 relay can turn compromised devices into proxies, including through an outbound encrypted connection that avoids exposing a listener.
Evooo1Bot uses multiple persistence mechanisms and checks for analysis tools, honeypots, and virtualized environments.
Fortinet reports antivirus, web-filtering, and IPS protections for the malware and related activity; it recommends patching internet-facing devices, updating firmware, and monitoring outbound connections.

Article Details

Attack Vectors: FortiGuard Labs observed exploitation of Internet-facing edge devices, with payload callbacks pointing to a shared loader script.
The loader downloads and executes architecture-matched binaries using wget, busybox wget, curl, or tftp, then clears Bash history.
A built-in SSH scanner attempts logins using a dictionary of more than 150 credentials and delivers persistence payloads only after targets pass honeypot checks.
An HTTP-based exploit dispatcher substitutes an operator-supplied payload host into delivery commands. Some embedded exploit entries have implementation errors and are non-exploitable as shipped, including the reported MOVEit Transfer entry.
The malware supports remote shell execution, bidirectional file transfers, credential sniffing, SOCKS5 proxying, and multiple DDoS flood methods.
The persistence command installs systemd, SysV init, cron, shell-profile, and rc.local mechanisms simultaneously.
Defensive Notes: Prioritize timely patching and regular firmware updates for Internet-facing devices and network appliances.
Continuously monitor suspicious outbound connections and promptly remediate vulnerable systems.
Startup checks search for analysis tools, sandbox services, virtual-machine fingerprints, and container fingerprints; SSH propagation separately checks banners and post-login host characteristics for honeypots.
C2 connections use port 443 to blend with expected HTTPS traffic, while reverse SOCKS relaying establishes outbound encrypted connections rather than exposing a listening port.
Fortinet states that FortiGuard Antivirus detects the malware as Linux/Agent.BDS!tr and that up-to-date signatures in its integrated products protect against the described malware components.
Fortinet states that its Web Filtering Service blocks the C2 server and that its IPS signatures cover the vulnerabilities listed in the protection section.

Indicators of compromise

Type	Indicator	Context
IPV4	`91[.]92[.]40[.]118`	IP explicitly listed as an IOC and used to host the Evooo1Bot loader script.
SHA256	`4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4d`	Malware hash listed in the Evooo1Bot IOC section.
SHA256	`f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109`	Malware hash listed in the Evooo1Bot IOC section.