New Mirai-Based Evooo1Bot Malware Adds Stealth and Proxy Capabilities
Summary
Researchers say Evooo1Bot, a previously undocumented Mirai-based malware, has exploited unpatched internet-facing devices for at least a month. Its capabilities include encrypted C2, SSH scanning, honeypot avoidance, credential sniffing and SOCKS proxy abuse.
Key points
- FortiGuard Labs researchers say the Linux-based Evooo1Bot has been actively exploiting unpatched internet-facing devices for at least a month; the number of compromised devices is unknown.
- The malware targets routers and other hardware from Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda and Telesquare.
- Its reported capabilities include encrypted command-and-control communications, SSH scanning that avoids apparent honeypots, and sniffing for unchanged default credentials.
- Evooo1Bot abuses SOCKS proxies to conceal attackers’ origins and potentially pivot through compromised devices into internal networks, according to FortiGuard Labs.
- Company telemetry showed activity concentrated in North America, South America, Europe, India, China and Japan.
Article Details
- Event Type
- Discovery and reported active exploitation of unpatched internet-facing devices by the Mirai-based Evooo1Bot malware variant.
- Impact
- Evooo1Bot can compromise routers and other edge devices, use them as persistent SOCKS proxies to conceal attacker origin and pivot into internal networks, and perform DDoS-related activity. The number of compromised devices is not specified.
MITRE ATT&CK
T1046 · Network Service DiscoveryEvooo1Bot scans for SSH code on devices, according to the report.T1090 · ProxyEvooo1Bot abuses SOCKS proxies on compromised devices to conceal attacker origin and pivot into internal networks.T1190 · Exploit Public-Facing ApplicationResearchers report that Evooo1Bot has been exploiting vulnerabilities in unpatched internet-facing devices.T1573 · Encrypted ChannelThe malware uses encrypted communications with command-and-control servers.
Malware
Evooo1BotEvooo1Bot is a previously undocumented Mirai-based malware variant that has been actively exploiting unpatched internet-facing devices from multiple hardware vendors for at least a month.MiraiEvooo1Bot is a previously undocumented Mirai-based malware variant that has been actively exploiting unpatched internet-facing devices from multiple hardware vendors for at least a month.
Vendors
Alcatel#Evooo1BotD-LinkDubbed Evooo1Bot, the Linux-based malware targets routers and other hardware from Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda and Telesquare, according to researchers at FortiGuard Labs.Mitsubishi ElectricDubbed Evooo1Bot, the Linux-based malware targets routers and other hardware from Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda and Telesquare, according to researchers at FortiGuard Labs.NETGEAR#Evooo1BotTelesquare#Evooo1BotTenda#Evooo1Bot
Countries
ChinaThe report does not specify how many devices have been compromised worldwide, but the company’s telemetry shows activity concentrated in North America, South America, Europe, India, China and Japan.IndiaThe report does not specify how many devices have been compromised worldwide, but the company’s telemetry shows activity concentrated in North America, South America, Europe, India, China and Japan.JapanThe report does not specify how many devices have been compromised worldwide, but the company’s telemetry shows activity concentrated in North America, South America, Europe, India, China and Japan.