Security researchers have flagged a Linux botnet family that was not previously documented publicly: Evooo1Bot. The core of the threat is especially striking: the malware package can turn internet-facing devices into a SOCKS5 proxy. That gives the attacker more computing power, but also a useful way to hide follow-up traffic and move more precisely.
According to Fortinet FortiGuard Labs, the malware reuses base functionality from Mirai’s source code. At the same time, Evooo1Bot extends the system with additional modules, including encrypted command-and-control (C2) communications, an SSH brute-force scanner, a credential sniffer, and an exploit arsenal targeting known vulnerabilities. The botnet has been visible in the wild since July 2026.
What is Evooo1Bot?
Evooo1Bot is designed to compromise edge devices such as routers and firewalls that are publicly reachable. Once a device is hit, the malware registers itself with the C2 infrastructure and waits for instructions from the attacker.
Where Mirai is best known for DDoS capabilities, Evooo1Bot focuses on combining existing attack techniques with extra features that increase the value of each infected device. This happens through network relay behavior and by selectively exploiting weak spots in equipment.
Evooo1Bot SOCKS5-proxy: why it’s so valuable
The most notable feature is the proxy component. With it, an infected router, firewall, IP camera, or other edge device can act as a SOCKS5 proxy. For the attacker, that means traffic can be routed through the compromised device as part of follow-up activities.
Researchers indicate that this can serve multiple purposes:
- IP masking: attackers can use the victim’s IP address to make malicious network traffic less recognizable.
- Bypassing restrictions: for example, geographic restrictions or other access filters.
- Access to internal networks: by using an already compromised system, it becomes easier to later move toward internal environments.
In larger botnets, the same proxy functionality can evolve into a distributed infrastructure for anonymous relaying—or even business models built around proxy services.
From infection to loader: how Evooo1Bot starts
The rollout typically begins by running a loader shell script, referred to as wget.sh. This script is hosted externally (listed as 91.92.40[.]118) and is used to download a bot binary suited to the CPU architecture of the target device.
After that, the malware takes extra steps to reduce traces. One of these measures is clearing Bash history so potential indicators of the attack are less visible to anyone inspecting the system locally.
Detection of analysis environments
Next, the binary checks whether it is running in an environment with analysis tools, sandbox-like setups, or virtualized systems. Only if those signals are missing does the malware proceed to the next phase.
Encrypted C2 and communication via port 443
To enable command from within the botnet, Evooo1Bot establishes encrypted communication with a command-and-control server, using port 443.
The choice of 443 is not arbitrary. By behaving like normal HTTPS traffic, the malware can blend better into routine perimeter communications. After registration with the C2 server, it enters a waiting phase for commands.
Commands and modules: from proxy to DDoS and control actions
Once active, Evooo1Bot supports multiple commands and capabilities. Researchers describe, among other things, options to:
- Install or maintain persistence
- Update the bot binary
- Terminate the malware when needed
- Upload or download files
- Start an interactive shell
- Intercept HTTP Basic Authorization and Cookie headers
- Convert the device into a proxy node (SOCKS5)
- Start a SSH brute-force scanner
- Trigger DDoS attacks via DNS, TCP, and UDP
- Use an HTTP-based exploit dispatcher for known vulnerabilities
This mix shows that Evooo1Bot is not only focused on compromising systems, but also on expanding and setting up routes for follow-up traffic.
Exploit arsenal: known CVEs in public edge devices
The attack includes a CVE module that allows the botnet to launch exploits for eight vulnerabilities. Reported targets range from camera and networking components to applications and platform software.
Examples of vulnerabilities that Evooo1Bot may exploit include:
- CVE-2021-36260 (Hikvision)
- CVE-2022-26134 (Atlassian Confluence)
- CVE-2022-29464 (WSO2)
- CVE-2022-30525 (Zyxel)
- CVE-2023-1389 (TP-Link)
- CVE-2024-4577 (PHP)
- CVE-2024-10914 (D-Link)
- CVE-2025-1974 (Kubernetes)
In addition, Fortinet lists multiple other CVEs that were linked by the botnet family to the compromise of various vendor systems. Examples mentioned include CVE-2007-3010 (Alcatel OmniPCX Enterprise), CVE-2016-6277 (NETGEAR routers), CVE-2018-14558 (Tenda AC7/AC9/AC10), and a range of vulnerabilities affecting Tenda, Telesquare, D-Link, and more.
In short: Evooo1Bot targets devices and services with known weaknesses—often ones that remain reachable from the internet due to management backlog or insufficient hardening.
What can you do to limit this type of threat?
Because the botnet relies on known vulnerabilities and edge systems accessible from the public internet, prevention mainly comes down to reducing the attack surface and quickly patching known flaws.
- Patch edge equipment: routers, firewalls, and IP cameras should be maintained under a strict patching regime, including models that are not covered by standard application update processes.
- Restrict external access: only expose services that are truly necessary to the public, and use VPNs or IP allowlisting whenever possible.
- Check SSH behavior: increased brute-force attempts can be a sign that a botnet is trying to spread further.
- Watch for unusual C2 patterns: communication on port 443 is not automatically suspicious, but combine network logs with other signals such as unexpected outbound connections or new processes.
- Monitor for proxy activity: if an edge device suddenly shows proxy- or relay-like behavior, treat it as an alert.
If you want to dig deeper into how botnets and exploit chains can come together in practice, this article about a similar exploit chain may help: Unisoc VoLTE video call: exploit chain up to the kernel. And for broader context on abusing infrastructure for follow-up actions, this is also relevant: Prevention stalls inside the network.
Why this advisory deserves extra attention
Evooo1Bot is not “classic” malware aimed at a single objective. By turning edge devices into SOCKS5 proxies, the botnet makes its victims more valuable to attackers: it can hide follow-up traffic, facilitate access, and carry out attacks more efficiently.
Moreover, the malware combines multiple attack lines—from exploit distribution to DDoS, from SSH brute-force to intercepting certain HTTP authentication data. That increases the chance that a compromised device does not stay limited to a single incident.
Conclusion
The Linux botnet Evooo1Bot SOCKS5 proxy shows how threats evolve from purely DDoS usage into multifunctional platforms. With encrypted C2 on port 443, an exploit arsenal with known CVEs, and the ability to use edge devices as SOCKS5 proxies, the botnet magnifies the impact of each compromise.
For organizations, the key takeaway is to keep edge equipment up to date, limit public exposure, and monitor behavior that doesn’t match normal use. By intervening early with patching and access protection, you can prevent known vulnerabilities from being used to turn devices into part of a proxy infrastructure.
Source: https://thehackernews.com/2026/08/evooo1bot-linux-botnet-exploits-known.html
