New Evooo1Bot Linux Botnet Turns Routers Into Traffic Relay Nodes

Overview

Researchers at FortiGuard Labs have disclosed a sophisticated new Linux botnet dubbed Evooo1Bot — a Mirai-derived threat that significantly extends the traditional DDoS-for-hire playbook by transforming compromised routers and edge devices into persistent SOCKS5 proxy relay nodes. Active since at least July 2026, the botnet has been observed targeting devices across North America, South America, Europe, India, China, and Japan.

The malware takes its name from the hardcoded string evooo1 embedded in every compiled binary — a campaign tag the operator uses to track per-vulnerability infection yields.

Targeted Devices and Exploited CVEs

Evooo1Bot targets a wide range of consumer and enterprise edge hardware using eight known vulnerabilities, ranging from a 2007-era legacy flaw to a newly disclosed 2025 bug:

All initial payloads call back to 91.92.40[.]118/wget.sh, and campaign labels embedded in download commands (such as -s mitsu or rep.alcatel) let the operator monitor per-exploit infection rates independently.

Key Capabilities

SOCKS5 Relay Module

The most operationally significant feature is Evooo1Bot's SOCKS5 proxy module, which converts each compromised router into a persistent relay node. The relay uses a reverse-proxy architecture that decouples session control from data traffic — allowing threat actors to completely obscure their true IP origin while tunneling connections into internal corporate networks through trusted-looking edge devices. This capability positions the botnet as an access broker tool as much as a DDoS platform.

Encrypted Command and Control

C2 communications use a layered encryption scheme combining AES-256-CTR, ChaCha20, and XOR-based key derivation. The multi-layer approach makes traffic analysis and signature-based detection significantly harder than typical Mirai variants.

Additional Capabilities

• 28-command remote administration interface — full operator control over infected nodes
• 16 distinct DDoS attack vectors — carries the Mirai volumetric DDoS engine forward
• SSH brute-force scanner — for lateral infection across the network
• Credential sniffer — harvests authentication data from compromised devices
• Honeypot detection — embedded evasion banners to identify and avoid sandbox analysis environments
• Anti-analysis techniques — complicates dynamic and static reverse engineering

Strategic Shift from Traditional Mirai

What distinguishes Evooo1Bot from its ancestors is its dual-purpose design. Traditional Mirai variants were purpose-built for volumetric DDoS attacks. Evooo1Bot treats DDoS as a secondary capability — its primary value proposition is covert, long-term SOCKS5 proxy persistence for enterprise network infiltration and anonymization. This represents an evolution toward access brokering: compromised devices become sellable or rentable proxy nodes used to launch further attacks, bypass geo-restrictions, or tunnel into corporate environments undetected.

Mitigation and Recommendations

Organizations running the affected hardware should:

1. Apply available firmware patches for all listed devices immediately — many of the exploited CVEs have been public for years
2. Audit edge device access logs for unexpected outbound connections, particularly to 91.92.40[.]118
3. Disable remote administration interfaces on consumer routers when not explicitly needed
4. Change default credentials on all routers and edge devices — SSH brute-force is an active component
5. Segment IoT and edge devices from internal corporate networks to limit lateral movement potential
6. Monitor for SOCKS5 proxy traffic originating from router or gateway hosts — this is abnormal and warrants investigation

References

• FortiGuard Labs: Multi-Functional Linux Botnet "Evooo1Bot"
• BleepingComputer: New Evooo1Bot Linux Botnet Turns Routers into Traffic Relay Nodes
• Infosecurity Magazine: New Mirai-Based Linux Botnet 'Evooo1Bot' Turns Victims Into Proxies