News › security
By Zayden R., August 17, 2026
A new Linux botnet, Evooo1Bot, is using known vulnerabilities to turn edge devices into SOCKS5 proxies. This botnet, active since July 2026, builds on Mirai's code, adding features like encrypted communications and a credential sniffer.
Cybersecurity researchers have identified a new Linux botnet, Evooo1Bot, which is actively exploiting known vulnerabilities to transform internet-facing devices into SOCKS5 proxies. This botnet, first observed in the wild since July 2026, is derived from the infamous Mirai botnet source code. However, it extends Mirai's capabilities by incorporating encrypted command-and-control (C2) communications, an SSH brute-force scanner, a SOCKS relay module, and a credential sniffer, among other enhancements.
Fortinet FortiGuard Labs reports that Evooo1Bot targets a wide range of known vulnerabilities, including CVE-2007-3010 in Alcatel OmniPCX Enterprise systems, CVE-2016-6277 in NETGEAR routers, and newer flaws such as CVE-2025-10123 in D-Link DIR-823X routers. Once a device is compromised, the botnet executes a loader shell script, "wget.sh", from an external server to download the appropriate binary for the device's CPU architecture. The script then clears the Bash history to remove traces of the attack.
The malware's binary checks for analysis tools, sandboxes, and virtual environments before establishing encrypted communications with its C2 server over port 443, allowing it to blend in with regular HTTPS traffic. This strategic choice makes detection more challenging for network administrators and security systems.
For engineers and sysadmins, this development underscores the importance of regularly updating firmware and applying patches to all network-connected devices. Given the botnet's reliance on exploiting known vulnerabilities, maintaining an updated security posture is crucial in mitigating such threats. Monitoring network traffic for unusual patterns, particularly encrypted traffic on port 443, can also help in early detection.
Evooo1Bot's emergence highlights the persistent threat of botnets leveraging outdated and unpatched systems. While the botnet's reliance on known vulnerabilities might seem unsophisticated, its effective use of Mirai's architecture with modern enhancements poses a significant risk to unprotected systems.
The Linux Camp teaches these topics as hands-on labs on real virtual machines, verified as you type.