Evooo1Bot: Advanced Linux Botnet Exploiting IoT Vulnerabilities

FortiGuard Labs has identified a new modular Linux botnet named Evooo1Bot, active since July 2026. While it utilizes the publicly available Mirai source code for its DDoS engine, the botnet significantly extends its capabilities with encrypted C2 communications, SSH brute-forcing, and multi-layered persistence. The malware primarily targets edge devices, including routers from Tenda, D-Link, and Netgear, as well as enterprise applications like Atlassian Confluence and Kubernetes.

Technically, Evooo1Bot employs sophisticated anti-analysis checks to detect sandboxes and debuggers before establishing a connection to its C2 server on port 443. It features a notable SOCKS5 relay module that turns infected hosts into persistent proxy nodes, enabling attackers to mask their origin or pivot into internal networks. The botnet also uses a multi-layered string obfuscation pipeline involving AES-256-CTR and ChaCha20 to hinder analysis.

The operational impact of Evooo1Bot is critical due to its focus on persistent proxying and extensive vulnerability exploitation. By targeting a wide range of IoT and industrial control systems (ICS), the botnet provides its operators with a robust infrastructure for secondary attacks, data exfiltration, or anonymity services. Organizations should prioritize patching the 15+ CVEs identified in the botnet's exploit module and monitor for its distinct persistence mechanisms.