Full Report
Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. "While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including
Analysis Summary
# Tool/Technique: Evooo1Bot
## Overview
Evooo1Bot is a sophisticated, undocumented Linux-based botnet discovered in mid-2026. While it utilizes the DDoS engine from the leaked Mirai source code, it significantly expands upon the original framework by incorporating advanced proxying capabilities, an exploit arsenal for edge devices, and encrypted command-and-control (C2) communication. Its primary purpose is to convert internet-facing IoT and edge devices into SOCKS5 proxies for traffic relaying and to conduct large-scale DDoS attacks.
## Technical Details
- **Type:** Malware family (Botnet)
- **Platform:** Linux (Multiple CPU architectures including routers, firewalls, and IP cameras)
- **Capabilities:** DDoS attacks (TCP/UDP/DNS), SOCKS5 proxy relay, SSH brute-forcing, credential sniffing (HTTP Basic Auth/Cookies), vulnerability exploitation, and remote shell access.
- **First Seen:** July 2026
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application
- **TA0002 - Execution**
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- **TA0003 - Persistence**
- T1547 - Boot or Logon Autostart Execution
- **TA0005 - Defense Evasion**
- T1070.003 - Indicator Removal: Clear Command History
- T1497 - Virtualization/Sandbox Evasion
- T1573.001 - Encrypted Channel: Symmetric Cryptography
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0009 - Collection**
- T1557 - Adversary-in-the-Middle (Credential Sniffing)
- **TA0011 - Command and Control**
- T1090.003 - Proxy: Multi-hop Proxy
- T1105 - Ingress Tool Transfer
## Functionality
### Core Capabilities
- **DDoS Engine:** Inherited from Mirai, capable of launching volumetric attacks via DNS, TCP, and UDP protocols.
- **Exploit Arsenal:** Features a built-in module to exploit at least 10 known vulnerabilities (CVEs) in networking equipment and software (e.g., D-Link, Tenda, Netgear, Alcatel).
- **C2 Communication:** Communicates over port 443 using encryption to blend in with legitimate HTTPS traffic.
- **Persistence & Maintenance:** Includes commands for self-updating, installing persistence mechanisms, and terminating the bot process.
### Advanced Features
- **SOCKS5 Proxy Relay:** Transforms infected devices into proxy nodes, allowing attackers to tunnel malicious traffic through the victim's IP to mask origin or access internal networks.
- **Credential Sniffer:** Intercepts HTTP Basic Authentication and Cookie headers to steal session information and credentials.
- **SSH Brute-Force Scanner:** Actively scans for other reachable devices to perform credential stuffing and lateral movement.
- **Interactive Shell:** Allows operators to execute arbitrary commands on the infected host.
## Indicators of Compromise
- **File Hashes:**
- (Specific binary hashes not provided in text, but includes "wget.sh" loader script)
- **File Names:** `wget.sh` (Loader script)
- **Network Indicators:**
- `91.92.40[.]118` (Malware hosting/C2)
- Port `443` (C2 traffic)
- **Behavioral Indicators:**
- Clearing of Bash history (`history -c`).
- Outbound SSH scanning activity (Port 22).
- Rapid exploitation attempts against known CVEs (e.g., CVE-2024-29269, CVE-2025-10123).
- Anti-sandbox and anti-analysis checks upon execution.
## Associated Threat Actors
- Currently unattributed (Unknown threat actor).
## Detection Methods
- **Signature-based:** Detect the `wget.sh` loader script and Mirai-based DDoS strings within Linux ELF binaries.
- **Behavioral:** Monitor for unusual outbound traffic on Port 443 that does not follow standard TLS handshakes, and spikes in Port 22 (SSH) scanning.
- **System Monitoring:** Audit shell command history for the deletion of history files or automated `wget`/`curl` fetches to known malicious IPs.
## Mitigation Strategies
- **Patch Management:** Prioritize patching edge devices against the specific CVEs listed (notably D-Link, Tenda, and TP-Link vulnerabilities).
- **Network Hardening:** Disable unnecessary remote management interfaces (SSH, Web UI) on the WAN side.
- **Access Control:** Implement strong, unique passwords for all IoT and networking equipment to defeat brute-force modules.
- **Egress Filtering:** Restrict outbound traffic from IoT devices to only necessary ports and destinations.
## Related Tools/Techniques
- **Mirai:** The source code foundation for Evooo1Bot.
- **SOCKS5 Proxying:** A technique frequently used by "Proxy-as-a-Service" botnets to monetize infected hardware.