cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Evooo1Bot Linux Botnet Turns Gateway Devices Into SOCKS5 Relays

· Original article ↗

Summary

Fortinet researchers describe Evooo1Bot, a Mirai-based Linux botnet targeting internet-facing devices. It can relay traffic, steal credentials, brute-force SSH, and launch DDoS attacks; some embedded exploits reportedly fail.

Key points

  • Evooo1Bot targets internet-facing gateway devices from multiple vendors by exploiting known vulnerabilities.
  • The botnet can turn compromised devices into SOCKS5 relays and supports direct-listening and reverse-relay modes.
  • Its modules include a credential sniffer targeting HTTP Basic Authentication and Cookie headers, an SSH brute-force scanner, and a DDoS engine with 16 flood methods.
  • It uses encrypted command-and-control over port 443, checks for analysis environments, and establishes persistence through several Linux startup mechanisms and a recurring cron job.
  • Fortinet says some embedded exploits are incorrectly implemented and fail; successful exploitation can download a malware build matched to the host's CPU architecture.
  • Recommended defenses include updating IoT firmware, replacing default credentials, disabling remote access panels, and replacing unsupported devices.

Article Details

Attack Vectors
  • Exploits known vulnerabilities in internet-facing gateway devices and other targeted systems; Fortinet reports that some embedded exploits are incorrectly implemented and fail.
  • Uses an SSH brute-force scanner with 150 username and password combinations.
  • A successful exploit can trigger a script to download a malware build matching the host's CPU architecture.
  • A credential-sniffer module monitors /proc/net/tcp and attempts to capture HTTP Basic Authentication and Cookie headers.
  • The botnet can use compromised devices as SOCKS5 relays and launch DDoS floods.
Defensive Notes
  • Keep IoT device firmware updated.
  • Replace default administrator credentials.
  • Turn off remote-access panels.
  • Replace devices when their vendors no longer provide support.

MITRE ATT&CK

T1037.004 · RC ScriptsThe malware establishes persistence through SysV init and rc.local.T1040 · Network SniffingThe credential-sniffer module monitors /proc/net/tcp and attempts to capture HTTP Basic Authentication and Cookie headers.T1053.003 · CronA cron job attempts to re-download the payload every five minutes.T1070.003 · Clear Command HistoryAfter downloading a malware build, the script clears Bash history to wipe traces.T1090.002 · External ProxyEvooo1Bot turns compromised devices into SOCKS5 relay nodes that can conceal malicious traffic.T1105 · Ingress Tool TransferAfter successful exploitation, a script downloads an Evooo1Bot build matched to the host's CPU architecture.T1110.001 · Password GuessingIts SSH scanner attempts logins using 150 username and password combinations.T1497.001 · System ChecksBefore launching, the malware checks for sandboxes, virtual machines, and containers.T1498.001 · Direct Network FloodThe inherited Mirai DDoS module supports multiple flood methods, including UDP, SYN, ACK, and HTTP floods.T1543.002 · Systemd ServiceThe malware establishes persistence through systemd.T1546.004 · Unix Shell Configuration ModificationThe malware establishes persistence through shell profiles.T1622 · Debugger EvasionEvooo1Bot checks for debuggers before launching.

Malware

Evooo1BotEvooo1Bot is a new Mirai-based modular Linux botnet that targets internet-facing gateway devices to turn them into SOCKS5 relay nodes while also enabling credential theft, SSH brute-forcing, and DDoS attacks.MiraiEvooo1Bot is a new Mirai-based modular Linux botnet that targets internet-facing gateway devices to turn them into SOCKS5 relay nodes while also enabling credential theft, SSH brute-forcing, and DDoS attacks.

Vendors

AlcatelIt has been observed exploiting multiple known vulnerabilities across devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision,AtlassianNewer builds include a separate vulnerability-exploitation module targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, andD-Linkknown vulnerabilities across devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2, KubernetesHikvisionTenda, Mitsubishi Electric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2, Kubernetes ingress-nginx, and PHP-CGI systems.Mitsubishi Electricobserved exploiting multiple known vulnerabilities across devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision, Confluence, Zyxel,NETGEARIt has been observed exploiting multiple known vulnerabilities across devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision,Telesquaremultiple known vulnerabilities across devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2,TendaIt has been observed exploiting multiple known vulnerabilities across devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision,TP-LinkTelesquare, D-Link, and other platforms, with newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2, Kubernetes ingress-nginx, and PHP-CGI systems.WSO2D-Link, and other platforms, with newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2, Kubernetes ingress-nginx, and PHP-CGI systems.ZyxelElectric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2, Kubernetes ingress-nginx, and PHP-CGI systems.

Products

ConfluenceMitsubishi Electric, Telesquare, D-Link, and other platforms, with newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2, Kubernetes ingress-nginx, and PHP-CGI systems.Kubernetes ingress-nginxand other platforms, with newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2, Kubernetes ingress-nginx, and PHP-CGI systems.LinuxEvooo1Bot is a new Mirai-based modular Linux botnet that targets internet-facing gateway devices to turn them into SOCKS5 relay nodes while also enabling credential theft, SSH brute-forcing, and DDoS attacks.PHP-CGIwith newer builds targeting Hikvision, Confluence, Zyxel, TP-Link, WSO2, Kubernetes ingress-nginx, and PHP-CGI systems.

Related Articles