Full Report
Beyond Mirai’s usual functions, the new code features include encrypted communications with command-and-control servers and a “sniffer” that looks for default access credentials.
Analysis Summary
# Tool/Technique: Evooo1Bot (Mirai Variant)
## Overview
Evooo1Bot is a sophisticated Linux-based malware family derived from the original Mirai source code. It targets internet-facing hardware, specifically IoT devices and networking equipment, to incorporate them into a botnet. Unlike standard Mirai variants that focus primarily on DDoS, Evooo1Bot includes advanced stealth, proxying, and credential-sniffing capabilities, making it a significant threat for network pivoting and persistent unauthorized access.
## Technical Details
- **Type:** Malware family (Mirai variant)
- **Platform:** Linux (IoT/Edge devices including routers, firewalls, and IP cameras)
- **Capabilities:** DDoS, Encrypted C2, SSH Scanning, Honeypot Evasion, Credential Sniffing, SOCKS Proxying.
- **First Seen:** July 2026 (Active for at least one month prior to August 2026 report)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application]
- **[TA0005 - Defense Evasion]**
- [T1571 - Non-Standard Port] (Encrypted C2)
- [T1012 - Query Registry] (Honeypot detection/environment fingerprinting)
- **[TA0007 - Discovery]**
- [T1046 - Network Service Scanning] (SSH scanning)
- **[TA0006 - Credential Access]**
- [T1040 - Network Sniffing] (Sniffing for default credentials)
- **[TA0011 - Command and Control]**
- [T1090 - Proxy] (SOCKS protocol abuse for pivoting)
- [T1573 - Encrypted Channel] (Encrypted C2 communications)
- **[TA0040 - Impact]**
- [T1498 - Network Denial of Service] (DDoS capabilities)
## Functionality
### Core Capabilities
- **DDoS Attacks:** Inherits the standard Mirai capability to launch distributed denial-of-service attacks.
- **Vulnerability Exploitation:** Actively exploits unpatched bugs in hardware from manufacturers including Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda, and Telesquare.
- **SSH Scanning:** Systematically scans the internet for devices with open SSH ports to attempt lateral movement or infection.
### Advanced Features
- **Encrypted C2:** Implements encrypted communication channels to bypass legacy network security monitoring that relies on plaintext signature matching.
- **Credential Sniffing:** Includes a specialized "sniffer" designed to capture default access credentials that have not been changed by the user.
- **Honeypot Evasion:** Features logic to identify and skip devices recognized as honeypots, increasing the botnet's operational security.
- **SOCKS Proxying:** Utilizes the SOCKS protocol to transform compromised edge devices into persistent proxies. This allows attackers to hide their origin and tunnel into internal networks behind the compromised device.
## Indicators of Compromise
- **File Hashes:** [Specific hashes not provided in the article; analysis pending from FortiGuard Labs]
- **Network Indicators:**
- Communications with C2 servers over encrypted channels (specific IPs/Domains defanged: `[hx]tp[:]//example-c2[.]com`)
- Traffic utilizing SOCKS proxy protocols from unauthorized edge devices.
- **Behavioral Indicators:**
- High volume of outbound SSH (Port 22) scanning activity.
- Unexpected modifications to device firmware or startup scripts.
- Significant increase in outbound UDP/TCP traffic (during DDoS events).
## Associated Threat Actors
- While specific groups are not named, the malware is linked to the broader ecosystem of Mirai-descendant operators.
- Related Mirai-derived operations include **Aisuru** and **KimWolf**.
## Detection Methods
- **Signature-based detection:** Updated antivirus/IDS signatures for the Evooo1Bot Linux binary.
- **Behavioral detection:**
- Monitoring for unusual SOCKS proxy traffic originating from IoT devices.
- Detecting rapid outbound connection attempts on Port 22 (SSH).
- Identifying encrypted traffic patterns to known malicious or suspicious IP ranges.
- **Network Analysis:** Identifying "sniffer" activity where a device begins monitoring local network segments for plaintext credentials.
## Mitigation Strategies
- **Patch Management:** Immediate application of firmware updates for routers and IoT devices from Alcatel, D-Link, Mitsubishi, Netgear, Tenda, and Telesquare.
- **Credential Hygiene:** Change all default administrative passwords to strong, unique credentials upon device deployment.
- **Network Segmentation:** Place IoT and edge devices on isolated VLANs to prevent the SOCKS proxy/sniffing features from reaching sensitive internal data.
- **Disable Unnecessary Services:** Disable SSH, Telnet, and web management interfaces on the WAN (internet-facing) side of hardware.
## Related Tools/Techniques
- **Mirai:** The original source code and foundation.
- **KimWolf:** A recently targeted Mirai variant.
- **Aisuru:** Another Mirai descendant focused on IoT exploitation.
- **SOCKS5 Proxying:** The technique used for stealthy network pivoting.