The newly discovered Evooo1Bot transforms compromised Linux devices into persistent attacker infrastructure, integrating credential theft and reverse SOCKS relays alongside traditional DDoS capabilities.
- Evooo1Bot evolves the Mirai codebase by adding modular exploitation, credential sniffing, and proxy capabilities.
- It targets unpatched edge devices from brands like NETGEAR, D-Link, and Alcatel using vulnerabilities as old as 2007.
- The reverse SOCKS relay allows attackers to route malicious traffic through victims' networks to mask their identity.
A sophisticated new threat actor has emerged in the Linux ecosystem. Tracked as Evooo1Bot by Fortiguard Labs, this botnet represents a significant evolution of the infamous Mirai malware. While Mirai was primarily known for orchestrating massive Distributed Denial of Service (DDoS) attacks, Evooo1Bot has transitioned into a multi-functional platform for long-term espionage and infrastructure hijacking.
The botnet specifically targets internet-facing Linux devices, including equipment from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link. Research indicates that the malware leverages a vast array of vulnerabilities, some dating back nearly two decades (e.g., CVE-2007-3010), highlighting a critical failure in legacy device lifecycle management across global organizations.
Why This Matters
BozokMedia analysis shows that Evooo1Bot is shifting the paradigm of botnet utility. It no longer just aims to knock a target offline; it aims to integrate the target into the attacker's own operational chain. By utilizing a Reverse SOCKS Relay, the botnet turns a simple home router or IP camera into a professional-grade proxy. This allows cybercriminals to pivot deeper into corporate internal networks while appearing as legitimate residential traffic.
"Evooo1Bot is not crude malware; its ability to detect honeypots and sandboxes indicates a professionalization of botnet development."
Beyond its proxy capabilities, the botnet is designed for extreme persistence. It utilizes systemd services, cron jobs, and shell profiles to ensure it remains active even after system reboots. Its maturity is further evidenced by its anti-analysis modules, which check for virtualized environments and debuggers before deploying the payload, making it a nightmare for traditional security researchers.
| Feature | Classic Mirai Botnets | Evooo1Bot Botnet |
|---|---|---|
| Primary Goal | DDoS / Traffic Flooding | Persistence / Proxying / DDoS |
| Network Reach | External Attack Only | Internal Network Pivoting |
| Stealth Level | Low (Noisy) | High (Anti-Analysis/SOCKS) |
Defenders are urged to prioritize the replacement of legacy network appliances that can no longer be patched. The integration of an SSH brute-force scanner means that even devices without known CVEs are at risk if they utilize weak or default credentials.
Frequently Asked Questions
Q1: How does Evooo1Bot gain access to a device?
It scans the internet for devices with known unpatched vulnerabilities or uses SSH brute-force attacks to guess usernames and passwords.
Q2: What is the most dangerous part of this botnet?
The SOCKS relay module, as it allows attackers to hide their origin and use your device as a gateway to attack other high-value targets.
