Evooo1Bot and GorillaBot: Mirai-Derived Multi-Functional Botnets

In late 2024 and mid-2026, researchers identified significant surges in Mirai-derived botnet activity, primarily driven by two families: GorillaBot and Evooo1Bot. GorillaBot launched over 300,000 DDoS attacks in a single month, targeting roughly 20,000 organizations globally using 19 different attack methods. More recently, Evooo1Bot has emerged as a significantly more sophisticated variant that extends traditional DDoS capabilities with a reverse SOCKS relay module, SSH brute-forcing, and an integrated exploit arsenal.

Technically, both botnets leverage an expansive list of vulnerabilities—some dating back to 2007—to compromise edge devices like routers, firewalls, and IP cameras. Evooo1Bot stands out for its operational maturity, featuring encrypted C2 communications over port 443, multiple layers of string obfuscation (AES, ChaCha20, XOR), and advanced anti-analysis checks for sandboxes and honeypots. The use of reverse SOCKS relays is particularly concerning, as it allows attackers to transform compromised devices into persistent proxies to pivot into internal networks.

These campaigns represent a professionalization of botnet tradecraft, where edge devices are no longer just tools for traffic flooding but serve as long-term infrastructure for concealing malicious origins and bypassing geographic or network restrictions. Affected sectors include gaming, telecommunications, and ISP services, with heavy targeting in China and the United States.