Evooo1Bot: A Mirai-Based Botnet Turning Linux Routers Into Attacker Infrastructure

On August 18, 2026, a newly identified Linux botnet is turning routers, firewalls, IP cameras and other internet-facing devices into distributed attacker infrastructure — for cyberattacks, credential theft, and covert traffic relaying. The malware, named Evooo1Bot, is built partly on the leaked source code of the infamous Mirai botnet, but its operators have expanded that formula into a much broader remote-access platform.

Why this matters now: this is not "just another Mirai DDoS bot." Fortinet's FortiGuard Labs, which began tracking it through its intrusion-prevention sensors, describes a multipurpose criminal operation with encrypted command-and-control, persistent access, an interactive shell, file transfer, an SSH brute-force scanner, and — most significantly — a SOCKS5 proxy service that lets attackers hide behind the IP address of a legitimate home or business.

What is Evooo1Bot?

The botnet's name comes from the hardcoded string "evooo1" found inside every binary Fortinet analysed. Telemetry indicates the campaign has been targeting internet-accessible devices across multiple regions since at least July 2026. The identity, location and motive of the operator remain unknown, but the design points to a flexible, general-purpose criminal platform rather than a DDoS-only tool. Fortinet rated it critical severity because successful exploitation gives the attacker remote control of the affected system.

A note on scale: Fortinet has not disclosed how many devices are infected, and the observed geographical spread should not be read as a definitive measurement of the botnet's total size.

How it gets in: years-old vulnerabilities

Evooo1Bot does not rely on a single zero-day. Instead, its operators scan the internet for devices still exposed to a collection of previously disclosed flaws — some almost two decades old — in equipment from Alcatel-Lucent, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link. The initial exploitation traffic targeted remote-code-execution, command-injection and buffer-overflow weaknesses, including:

• CVE-2007-3010 — Alcatel OmniPCX Enterprise
• CVE-2016-6277 — multiple NETGEAR routers
• CVE-2018-14558 — Tenda AC7 / AC9 / AC10
• CVE-2019-14931 — Mitsubishi Electric and INEA ME-RTU
• CVE-2020-10987 — Tenda AC15 AC1900
• CVE-2021-46422 — Telesquare SDT-CW3B1
• CVE-2022-37055 — D-Link routers
• CVE-2024-29269 — Telesquare TLR-2005KSH
• CVE-2025-10123 — D-Link DIR-823X
• CVE-2025-55583 — D-Link DIR-868L B1

The age and breadth of that list captures the core problem of edge-device security: appliances stay connected long after security support ends, and administrators often have far less visibility into their firmware than into ordinary servers. Sometimes a patch exists but was never installed; sometimes the product is end-of-life and needs replacing, not patching. A device that keeps working reliably is easily forgotten — while its management interface stays exposed and is scanned for automatically.

Fortinet observed the exploitation attempts calling back to a loader at 91.92.40[.]118/wget.sh, with labels identifying the targeted product — suggesting the operator tracks infection rates per exploit campaign to decide where to point scanning resources.

The loader: built for diverse hardware

After a device is exploited, the attacker runs a shell script (wget.sh) that retrieves the right Evooo1Bot binary for the compromised system. Because edge devices use many different processor architectures, the loader ships 12 binary variants and tries several transfer utilities — wget, BusyBox wget, curl, and TFTP — to maximise the chance a download succeeds.

The binary is written to a temporary location, marked executable, and launched. The script then clears the device's Bash history to hide the installation commands. That is only a superficial anti-forensic measure — it does not erase network, process, filesystem or security-device telemetry — but it may frustrate a shallow inspection. The multi-architecture approach also means that blocking one binary does not neutralise the campaign; defenders need to hunt for the full infrastructure and behaviour, not one file hash.

Anti-analysis: it looks for researchers

Once running, Evooo1Bot checks whether it is being examined. It scans for dozens of debugging, reverse-engineering and monitoring tools — GDB, strace, Wireshark, tcpdump, YARA, Ghidra, IDA, radare2, Sysdig, bpftrace — and for markers of sandboxes, virtual machines and containers (VMware, VirtualBox, QEMU, Cuckoo, CAPE, Firejail, gVisor, and various analysis services). This is far more thorough than early Mirai variants, and is meant to keep the malware quiet inside a researcher's lab.

Its SSH scanner adds a two-stage honeypot screen: before authenticating, it compares the target's SSH banner against decoy systems (Cowrie, Kippo, OpenCanary); after a successful login, it checks for a genuine Linux kernel and looks for honeypot directories. Only systems that pass are selected for payload delivery. The scanner's dictionary holds more than 150 username/password combinations — and, notably, is not limited to consumer defaults. It includes jenkins, postgres, oracle, nagios and deploy, widening its reach to enterprise servers and operational-technology environments.

Encrypted command channel and a 28-command controller

Evooo1Bot connects to its command-and-control server over TCP port 443. Using the port associated with HTTPS helps malicious connections blend into perimeter traffic — though port 443 alone does not make the traffic legitimate HTTPS. Fortinet said the malware protects more than 60 static strings with layered encryption and obfuscation — AES-256-CTR, ChaCha20 and XOR-derived keys assembled at runtime rather than stored directly.

After registering an infected host, the latest build exposes a 28-command remote-administration interface: request system info, terminate or update the bot, upload/download files, run commands, start an interactive terminal, and background tasks. Its pseudo-terminal support gives the attacker a far more usable remote shell than a simple command-execution implant. File transfers work both directions (with a 10 MB download cap), letting operators exfiltrate data or drop secondary tools without re-exploiting the device.

Persistence: multiple footholds at once

The botnet can install several persistence mechanisms simultaneously — a systemd service disguised as an "Apache HTTPD Cache Manager," a SysV init script, injected commands in a shell profile, and edits to rc.local. It can also add a cron task that re-downloads and re-executes the malware every five minutes, so deleting the running binary without removing the scheduled job leads to rapid reinfection.

It further adjusts its out-of-memory score so the kernel is less likely to kill it under memory pressure, and holds /dev/watchdog open where available to avoid watchdog-triggered restarts. Which mechanisms succeed depends on the device's privileges and init system — but a command-injection flaw running as root grants extensive control. Because of this, a factory reset or full firmware reinstall is often safer than trying to remove individual files, especially when the integrity of the underlying OS cannot be established.

The SOCKS5 relay: what makes every infection valuable

The proxy module most clearly separates Evooo1Bot from a DDoS-only Mirai derivative. In direct mode it opens a SOCKS5 service on TCP port 1080 (trying an IPv6 dual-stack listener first, then IPv4), letting an operator route arbitrary TCP connections through the victim. A reverse-relay mode avoids exposing an inbound port entirely: the device makes an encrypted outbound connection to an attacker relay, and spins up new encrypted sessions on demand — which works better behind firewalls and NAT.

The payoff for attackers: they can disguise password attacks, scanning, fraud and account takeovers as traffic from a legitimate residential or corporate address, which tends to attract less scrutiny from fraud and reputation systems than known hosting providers. That access can be used directly, rented, or sold through an illicit proxy service.

This creates a second-order risk for victims: an organisation may first suffer an edge-appliance compromise, then later find its public IP associated with attacks on unrelated parties — leading to blocklisting, abuse complaints and an investigation, even though the visible traffic was generated by someone else.

Credential interception

Evooo1Bot includes a network-sniffing function that inspects Linux connection data and tries to capture HTTP Authorization and Cookie headers, writing what it collects to /tmp/.sniff.log. This specifically endangers unencrypted HTTP: Basic Authentication credentials are only encoded (not encrypted), and session cookies let an attacker impersonate a user without the password. On a router or gateway that sits in the network path, the ability to observe traffic can be more damaging than an ordinary endpoint infection. Widespread HTTPS limits what passive interception reveals, but legacy management interfaces, industrial systems and internal apps may still use plaintext HTTP.

The DDoS engine still works

Despite the extras, the Mirai heritage remains: Fortinet found a DDoS component structurally consistent with the leaked Mirai code, supporting 16 flooding techniques — UDP, DNS, TCP SYN, TCP ACK, GRE, fragmented TCP, high-packet-rate floods, and a customisable HTTP flood. Edge appliances make useful attack participants because they are always on, may have high upstream bandwidth, and are rarely watched by endpoint detection.

A built-in exploit dispatcher — with important caveats

Newer samples carry a separate HTTP exploit dispatcher, giving infected hosts a role in spreading the botnet. Its embedded table includes entries for CVE-2021-36260 (Hikvision cameras), CVE-2022-26134 (Atlassian Confluence), CVE-2022-29464 (WSO2), CVE-2022-30525 (Zyxel firewalls), CVE-2023-1389 (TP-Link Archer AX21), CVE-2024-4577 (PHP-CGI on Windows), CVE-2024-10914 (D-Link NAS), and CVE-2025-1974 (Kubernetes ingress-nginx).

Crucially, an embedded CVE string is not proof of working exploitation. Fortinet found incorrectly implemented entries — for example, code for CVE-2023-34362 (the MOVEit Transfer flaw) that tried to hit a presumed web-shell path without performing the upload sequence needed to place it. Some entries were classified as non-exploitable in their observed form. There are also architectural mismatches: CVE-2024-4577 targets PHP-CGI on Windows, while Evooo1Bot is a Linux binary. Defenders should distinguish a claimed exploit menu from verified capability.

Why edge devices are such attractive targets

An infected workstation gets caught by endpoint security, noticed by a user, or switched off overnight. A router, camera or industrial gateway is expected to run continuously, often has little local monitoring, and may run a stripped-down Linux with limited forensic access. These systems also sit at strategic positions — trusted public IPs, bridging external and internal networks, handling authentication and management traffic. A compromised firewall or router can be an entry point, an observation post and an attack relay at once. Evooo1Bot's mix of propagation, remote administration, interception, proxying and DDoS turns each vulnerable device into a reusable asset the operator can repurpose on demand.

A defender's checklist

• Inventory everything internet-reachable, and compare models and firmware against the campaign's CVEs — but do not stop at the published list, since the exploit catalogue changes.
• Disable remote admin interfaces you do not need; where remote access is required, put it behind a VPN, management network, or tight allowlist rather than exposing it globally.
• Replace default and reused credentials, especially for SSH and appliance-management accounts.
• Watch for unexplained outbound port-443 connections (examine the destination, certificate behaviour and protocol — blocking all 443 is impractical), an unexpected listener on TCP 1080, cron jobs that download something every five minutes, suspicious systemd/SysV services, edits to /etc/rc.local or /etc/profile.d, odd executables in temp directories, and the presence of /tmp/.sniff.log.
• Investigate connections to 91.92.40[.]118. Fortinet also published two SHA-256 indicators: f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109 and 4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4d. Treat indicators as investigative leads, not permanent controls — attackers rotate binaries, hosting and filenames quickly.
• If compromise is confirmed: isolate the appliance, collect evidence, assume any credentials or sessions it could see are exposed, rotate passwords from a trusted system, invalidate active sessions, and review logs for proxy traffic and lateral movement. Replace unsupported hardware — patching one flaw does not fix an appliance riddled with others or no longer receiving updates.

Why it matters in 2026

Evooo1Bot shows the Mirai source leak is still useful a decade on — but this is not a recycled DDoS threat. By fusing Mirai's flooding with persistence, credential interception, exploit automation and an encrypted SOCKS5 relay, its developers turned vulnerable Linux edge devices into a flexible platform for both direct attacks and concealed access. The lesson for defenders is that the humble router or camera is no longer a low-value target — it is a persistent, multipurpose foothold.

Conclusion

The most important shift here is conceptual: a compromised edge device is not just a DDoS zombie, it is reusable criminal infrastructure — an entry point, a wiretap, and a proxy rolled into one. Defending against it is less about chasing one binary and more about shrinking your internet-facing attack surface: know what is exposed, cut off remote management, fix credentials, and replace hardware that no longer gets security updates.

Merits

• The core initial-access vector is old, disclosed CVEs — meaning patching, allowlisting and retiring end-of-life gear genuinely closes the door.
• Fortinet has published concrete indicators (a C2 IP and two file hashes) and clear behavioural signs to hunt for.
• The malware has real implementation flaws — several embedded exploits are non-functional or architecturally mismatched, so the "menu" overstates its true reach.
• Its anti-forensics (clearing Bash history) are shallow and leave plenty of other telemetry.

Demerits

• It is multipurpose and repurposable — DDoS, proxying, credential theft and self-propagation in one implant.
• Persistence is layered (systemd, cron every five minutes, rc.local, shell profiles), so half-measures cause reinfection.
• The SOCKS5 relay launders attacks through victims' trusted IPs, creating downstream blocklisting and liability.
• It hunts enterprise and OT credentials, not just IoT defaults, and is under active development with a changing exploit set.

Caution

This article summarises public reporting attributed to Fortinet's FortiGuard Labs and is for educational and defensive-awareness purposes only. Verify CVE applicability, indicators of compromise, and remediation steps against Fortinet's official advisory and the vendors' own guidance before acting — details, hashes and infrastructure change quickly, and an embedded CVE in malware is not proof it can reliably exploit your systems. Do not treat any single indicator here as a standalone, permanent control.

Frequently asked questions

• What is Evooo1Bot? — A Linux botnet, based partly on leaked Mirai source, that compromises internet-facing devices and turns them into multipurpose attacker infrastructure.
• Is it new malware or just Mirai? — Both. Its DDoS engine is Mirai-derived, but it adds encrypted C2, persistence, an interactive shell, an SSH scanner, credential sniffing, and a SOCKS5 relay.
• How does it infect devices? — By scanning for and exploiting years-old, publicly disclosed vulnerabilities in routers, firewalls and cameras — not a zero-day.
• What makes it more dangerous than a normal Mirai botnet? — The SOCKS5 relay (hiding attackers behind victims' IPs), credential interception, and layered persistence.
• What is the SOCKS5 relay used for? — Routing attacks, fraud and scanning through a victim's legitimate residential or corporate IP to evade reputation and fraud controls.
• Does it steal credentials? — Yes. It sniffs unencrypted HTTP Authorization headers and cookies, saving them to /tmp/.sniff.log.
• How do I know if a device is infected? — Look for a listener on TCP 1080, cron jobs downloading every five minutes, disguised systemd services, edits to rc.local/profile.d, odd temp-dir binaries, /tmp/.sniff.log, and outbound connections to the reported C2.
• How do I defend against it? — Patch or replace exposed devices, disable remote admin, fix default/reused credentials, and treat compromised appliances with a factory reset or firmware reinstall.

Sources and further reading

• Original analysis attributed to Fortinet FortiGuard Labs — see the official FortiGuard threat research advisory for the full technical write-up and current indicators.

Tags

#security #linux #iot #botnet #mirai #malware #cybersecurity #routers #ddos #threatintel