Cybersecurity researchers have identified Evooo1Bot, a new Linux botnet family derived from Mirai source code. The malware transforms internet-facing edge devices into SOCKS5 proxies to mask attacker identities.

  • Evooo1Bot leverages the leaked Mirai botnet source code for its core DDoS engine.
  • It converts infected Linux edge devices into SOCKS5 proxies for stealthy network routing.
  • The malware targets unpatched vulnerabilities in internet-facing hardware.

In a concerning development for global cybersecurity, researchers have uncovered a new Linux-based botnet dubbed Evooo1Bot. This malware family is specifically engineered to target edge devices—such as routers, IoT gateways, and Linux servers—transforming them into SOCKS5 proxies. By doing so, threat actors can route their malicious traffic through these compromised devices, effectively masking their true origin.

The architectural foundation of Evooo1Bot is rooted in the publicly leaked source code of the infamous Mirai botnet. However, Evooo1Bot is not a mere clone. It extends the original framework with advanced capabilities, enabling it to function not just as a tool for Distributed Denial of Service (DDoS) attacks, but as a sophisticated infrastructure for proxying illicit traffic.

Read Also:Meta Responds to Indian Government Over WhatsApp Username Feature Scrutiny

Why This Matters

BozokMedia analysis shows that the shift toward turning compromised devices into proxies represents a strategic evolution in cybercrime. By creating a distributed network of proxies, attackers can bypass IP-based blocking and evade detection by security operations centers (SOCs), making the attribution of attacks nearly impossible.

"The reuse of Mirai's code within Evooo1Bot highlights a dangerous trend where legacy malware is weaponized with modern stealth features to bypass contemporary defenses."

The infection vector primarily relies on known vulnerabilities and weak credentials. Once a device is breached, the botnet establishes persistence and begins scanning for other vulnerable targets on the network, creating a snowball effect that rapidly expands the botnet's footprint across the globe.

Did You Know?: The original Mirai botnet was famous for utilizing default factory usernames and passwords to infect millions of IoT devices worldwide.

Frequently Asked Questions

Q1: What is a SOCKS5 proxy in the context of a botnet?
A: It is a server that allows an attacker to send and receive packets of data through the infected device, making the attack appear as if it is coming from the victim's IP address.

Q2: How can administrators prevent Evooo1Bot infections?
A: By implementing strict firewall rules, updating firmware regularly, and disabling unnecessary services on internet-facing devices.