A newly observed Linux botnet dubbed Evooo1Bot is targeting internet-facing edge devices, including enterprise firewalls, SOHO routers, IP cameras, and industrial RTUs. FortiGuard Labs reports that the malware reuses the DDoS engine from the publicly leaked Mirai source code while adding capabilities including encrypted command-and-control (C2) communications, SOCKS5 proxy relaying, credential sniffing, SSH brute-force scanning, persistence, and automated vulnerability exploitation. Fortinet telemetry indicates that Evooo1Bot has been actively targeting internet-facing devices since July 2026.
For network operations teams, the key takeaway is a shift in operational risk: compromised edge devices are no longer just participating in outbound DDoS attacks. They can also be converted into proxy nodes capable of relaying arbitrary TCP traffic, concealing an attacker's origin and potentially providing access to internal networks through an already compromised device.
Vulnerability Delivery and Execution Pipeline
FortiGuard IPS telemetry observed active exploitation attempts against vulnerabilities affecting Alcatel OmniPCX, NETGEAR and Tenda routers, Mitsubishi Electric RTUs, Telesquare devices, and D-Link routers. Across the captured exploitation traffic, payload callbacks pointed to the same loader URL at 91.92.40[.]118/wget.sh.
Separately, Evooo1Bot contains an integrated HTTP exploit module covering additional targets, including Hikvision IP cameras, Zyxel firewalls, TP-Link routers, Atlassian Confluence, D-Link NAS devices, WSO2 products, PHP-CGI, and Kubernetes ingress-nginx. Fortinet notes that some exploit entries contain implementation errors and are non-exploitable as shipped.
When an observed exploit succeeds, it retrieves the wget.sh loader. The script identifies the host's CPU architecture and downloads one of 12 binary variants, attempting wget, BusyBox wget, curl, and tftp in that order. The binary is written to a temporary path, made executable, and launched, after which Bash history is cleared.
To complicate static analysis, Evooo1Bot protects more than 60 static string blocks using multiple layers of encryption and obfuscation. AES and ChaCha20 keys are not stored directly in the binary; instead, each key is represented by two 32-byte constants embedded in .data and reconstructed at runtime using XOR. A separate XOR decoding procedure protects a subset of strings in .rodata. Fortinet identifies AES-256-CTR, ChaCha20, and XOR-based key derivation among the techniques used.
Before establishing C2 communications, the malware searches for analysis tools such as gdb, tcpdump, and wireshark, along with fingerprints associated with virtualized, sandboxed, or isolated environments such as QEMU, VMware, VirtualBox, gVisor, and Kata Containers. Once these checks pass, it connects to its C2 server over TCP port 443, which Fortinet says was selected to blend in with expected HTTPS traffic at the network perimeter.
Functional Components: DDoS, SOCKS5 Relays, and Sniffing
Evooo1Bot exposes a broader modular remote-administration framework that includes persistence, self-update, control, file transfer, interactive shell, sniffing, SOCKS relaying, SSH scanning, DDoS, and CVE exploitation. Among these capabilities, three are particularly relevant to network operators.
1. Disruption Engine (16 DDoS Vectors)
The bot's DDoS engine is structurally consistent with the publicly leaked Mirai source code and supports 16 flood methods. These include generic and high-packet-rate UDP floods, TCP SYN and ACK floods, GRE-encapsulated IP and Ethernet floods, fragmented TCP floods, TCP attacks using different flag combinations, a DNS flood, Valve Source Engine query amplification, and other specialized attack variants.
Evooo1Bot also includes an HTTP flood variant. Operators can specify the HTTP method, headers, and expected values while customizing fields including User-Agent and Content-Length, extending the bot's attack capabilities beyond network- and transport-layer flooding.
2. SOCKS5 Proxy Relaying
The malware can turn an infected device into a SOCKS5 proxy in two modes. In direct mode, it opens a SOCKS5 listener on the infected host using TCP port 1080 by default. It first attempts to establish a dual-stack IPv6 listener and falls back to IPv4 if that fails.
In reverse mode, Evooo1Bot establishes an encrypted outbound connection to an operator-specified relay server rather than exposing a local listening port. When instructed to create a proxy session, the bot opens a second encrypted connection to the relay and passes it to its SOCKS5 proxy routine. This allows multiple proxy sessions to operate while maintaining a persistent control channel.
The result is particularly significant for defenders: an infected edge device can relay arbitrary TCP traffic using the victim's public IP address. Fortinet warns that this functionality could be used to disguise malicious traffic, bypass geographic restrictions, access internal networks through an already compromised system, or form part of a distributed proxy infrastructure.
3. Credential Sniffing, SSH Scanning, and Persistence
Evooo1Bot's sniffer reads /proc/net/tcp, intercepts cleartext HTTP Basic Authorization and Cookie headers, and writes captured information to /tmp/.sniff.log.
A built-in SSH scanner uses an embedded dictionary containing more than 150 credential entries. In addition to common IoT default credentials, the list contains service-account names such as jenkins, postgres, oracle, nagios, and deploy, extending its potential targets beyond consumer IoT devices into enterprise and operational-technology environments. The scanner also performs checks intended to identify and avoid SSH honeypots before delivering its persistence payload.
Persistence is established through several mechanisms simultaneously. These include a systemd service using the description Apache HTTPD Cache Manager, a SysV init script, a cron entry that attempts to retrieve the malware script every five minutes, /etc/profile.d/ injection, and modification of /etc/rc.local.
To resist termination, Evooo1Bot writes to /proc/self/oom_score_adj to reduce its priority as a target for the Linux OOM killer. It also keeps /dev/watchdog open, which Fortinet says is intended to prevent a device reboot from interrupting the malware's operation.
Primary Indicators of Compromise
| Indicator | Value | Description |
|---|---|---|
| Loader / IOC IP | 91.92.40[.]118 | IP associated with the observed wget.sh loader and listed by Fortinet as an IOC |
| Loader URL | 91.92.40[.]118/wget.sh | Loader observed in exploitation payload callbacks |
| ELF Sample 1 | f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109 | SHA-256 binary hash |
| ELF Sample 2 | 4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4d | SHA-256 binary hash |
Fortinet lists 91.92.40[.]118 and both SHA-256 hashes as indicators of compromise associated with Evooo1Bot.
For operators, the combination of DDoS functionality, vulnerability exploitation, persistent remote administration, credential interception, SSH scanning, and SOCKS5 proxying makes Evooo1Bot more capable than a conventional Mirai-derived DDoS bot. In particular, the reverse proxy functionality means a compromised router, firewall, camera, or other edge device can serve not only as a source of attack traffic but also as infrastructure for concealing and relaying subsequent malicious activity.
Read the full research from FortiGuard Labs here.
