Evooo1Bot: The Botnet Turning Routers and Edge Devices into…

Fortinet discovers Evooo1Bot, a modular Mirai-based Linux botnet active since July 2026 that exploits 10 known CVEs to build a distributed proxy infrastructure on compromised devices.

Fortinet FortiGuard Labs has identified and documented Evooo1Bot, a new modular Linux botnet family active since July 2026 that significantly extends the capabilities of traditional Mirai derivatives. On August 13, 2026, researcher Yi Ping (Cara) Lin published the full technical analysis: the malware does not stop at DDoS, but turns victims into dual-mode SOCKS5 proxies with encrypted C2 communications. The stakes represent a paradigm shift in IoT cybercrime, where technological obsolescence becomes low-cost anonymization infrastructure.

Key Takeaways

Evooo1Bot is a modular Linux botnet based on leaked Mirai source code, with a hardcoded "evooo1" string in every binary, discovered by Fortinet FortiGuard Labs.
It exploits 10 known vulnerabilities with CVSS scores up to 9.8 in edge devices from vendors including Alcatel, NETGEAR, Tenda, Mitsubishi/INEA, Telesquare, and D-Link, with CVEs spanning 2007 to 2025.
The SOCKS5 module operates in direct mode (listener on port 1080) and reverse relay mode (outbound connection to a relay server), turning compromised devices into persistent proxies.
Enterprise-grade anti-analysis mechanisms: checks for 40+ analysis tools, 17+ debugger processes, 11 sandbox services, and 13 VM/container fingerprints.

Exploit Arsenal: When Obsolescence Becomes the Vector

Evooo1Bot's primary exploit campaign leverages 10 documented vulnerabilities in internet-facing edge devices. According to NVD, CVE-2007-3010 in the Alcatel OmniPCX PBX carries a CVSS 9.8 CRITICAL rating, as do CVE-2018-14558 (Tenda command injection), CVE-2019-14931 (Mitsubishi/INEA RTU command injection), and CVE-2020-10987 (Tenda AC15 RCE). CVE-2016-6277 in NETGEAR firmware registers CVSS 8.8 HIGH. These are joined by CVE-2021-46422 (Telesquare), CVE-2022-37055 (D-Link), CVE-2024-29269 (Telesquare), CVE-2025-10123 (D-Link), and CVE-2025-55583 (D-Link).

All exploit callbacks converge on the same loader URL: 91.92.40[.]118/wget.sh. The loader downloads 12 binary variants for as many CPU architectures, using wget, busybox wget, curl, or tftp depending on availability on the compromised device. This multi-platform architecture allows the botnet to indifferently colonize consumer routers, entry-level firewalls, IP cameras, and industrial RTUs.

The broad temporal span of the vulnerabilities — from 2007 to 2025 — indicates operators are not betting on expensive zero-days, but on the accumulation of never-patched devices. Geographic telemetry reported by The Record shows activity in North America, South America, Europe, India, China, and Japan, confirming global spread.

The SOCKS5 Module: From DDoS to Proxy Infrastructure

Evooo1Bot reuses Mirai's DDoS engine with 16 attack methods, but the technically most relevant element is the SOCKS5 module. Yi Ping (Cara) Lin calls it "arguably the most operationally significant": the malware installs a SOCKS5 proxy supporting two operational modes.

In direct mode, the module opens a listener on port 1080 listening on both IPv4 and IPv6. In reverse relay mode, it instead establishes an outbound connection to a dedicated relay server, using RELAY_NEW and RELAY_DATA commands to encapsulate traffic. This duality allows both direct operational use by operators and the construction of large-scale distributed proxy networks.

Communications with the command-and-control server occur on port 43 with encrypted traffic, blending into standard HTTPS flows. Obfuscation uses AES-256-CTR, ChaCha20, and an XOR-based key derivation. The remote administration interface handles 28 commands, including !persist, !reinstall, !upload, !detach, !socks, !stopsocks, !cve, and !stopcve.

"These capabilities place Evooo1Bot well beyond the technical baseline of conventional Mirai-derived malware" — Yi Ping (Cara) Lin, Fortinet FortiGuard Labs

Fortinet FortiGuard Labs explicitly stated: "This capability significantly increases the value of an infected host to attackers. The victim's IP address can be used to disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine." And further: "In larger botnets, the same functionality could also be used to build a distributed proxy infrastructure, enabling anonymous traffic forwarding or monetization through residential and enterprise proxy services."

Persistence and Anti-Analysis: The Enterprise Grade Missing from IoT Botnets

Evooo1Bot implements five persistence mechanisms on compromised Linux systems: a systemd unit named "Apache HTTPD Cache Manager", a SysV init script, a cron job triggering every five minutes, a script in /etc/profile.d, and an entry in rc.local. The malware also modifies /proc/self/oom_score_adj to resist kernel termination attempts and interacts with /dev/watchdog.

Anti-analysis represents another quality leap over conventional Mirai derivatives. The binary checks for over 40 files associated with analysis tools, monitors 17+ debugger processes, detects 11 sandbox services, and calculates 13 fingerprints specific to virtualized or containerized environments. This level of sophistication indicates operators have invested considerable resources in protecting their arsenal.

The SSH scanner module integrates a dictionary of over 150 credentials and implements a two-stage honeypot detection, reducing the risk of exposure in research environments. An additional CVE module expands the attack surface with 8 further vulnerabilities in Hikvision, Atlassian Confluence, WSO2, Zyxel, TP-Link, PHP, D-Link NAS, and Kubernetes products, though the functional completeness of this secondary module is not fully verified in available sources.

Immediate Actions

The proxy nature of Evooo1Bot demands a rethink of traditional perimeter defenses. Priority actions derive directly from Fortinet's technical analysis:

Verify and apply patches for the 10 CVEs in the main campaign, with particular attention to edge devices with never-updated firmware, including industrial RTUs and obsolete PBXs.
Monitor outbound traffic on port 443 with TLS fingerprint analysis: Evooo1Bot's C2 communications use encryption but do not exactly replicate legitimate HTTPS client behavior.
Inspect systemd units, cron jobs, and rc.local files for anomalous entries, including the fake "Apache HTTPD Cache Manager" unit that does not correspond to authentic Apache processes.
Block the loader URL 91.92.40[.]118/wget.sh and related download variants at firewall and proxy level, notifying the indicator to industry threat intelligence platforms.

Proxy as a Commodity: A Structural Threat

Evooo1Bot is not an isolated episode, but an indicator of the Mirai ecosystem's maturation toward advanced persistent threats. The integration of SOCKS5 proxies, enterprise-grade anti-analysis, and multi-vector persistence on devices traditionally considered "simple" challenges the assumption that sophisticated attacks remain confined to corporate endpoints. The commoditization of proxy infrastructure lowers the barrier to distributed anonymization, with potential fallout for ad fraud, service abuse, and masked APT attacks.

The identity of the operators has not been determined from available sources. No infrastructure overlaps with other recent Mirai botnets such as Aisuru or KimWolf have emerged to date. The exact number of compromised devices is not quantifiable based on public data, nor is the actual existence of marketplaces already monetizing proxies generated by Evooo1Bot documented.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references