Evooo1Bot Botnet Weaponizes Edge Device Flaws

Security researchers have tracked a new modular Linux botnet that appears to have evolved well beyond the typical Mirai-based malware. The botnet, which FortiGuard Labs has named 'Evooo1Bot,' is linked to active exploitation attempts targeting a wide range of vulnerabilities in edge devices, including routers and other network equipment. The malware's unusual capabilities, such as encrypted command-and-control communications and a reverse SOCKS relay, suggest attackers are not just looking for DDoS firepower but also for covert access to compromised networks.

A Botnet With a Broader Mission

In an analysis shared on August 13, Fortinet's FortiGuard Labs researcher Yi Ping (Cara) Lin detailed the botnet's architecture and capabilities. The name 'Evooo1Bot' comes from the hardcoded string 'evooo1' present in every binary. While the botnet reuses the DDoS engine from the Mirai source code, it extends far beyond that, incorporating features like a 28-command remote administration interface, an SSH brute-force scanner, a credential sniffer, and multi-layered string obfuscation using AES-256-CTR, ChaCha20, and XOR-based key derivation.

The most operationally significant addition, according to Lin, is the reverse SOCKS relay module. This module transforms a compromised edge device into a persistent proxy, allowing the attacker to hide their true origin, pivot into internal networks, and conduct follow-on operations through the victim's infrastructure.

“These capabilities place Evooo1Bot well beyond the technical baseline of conventional Mirai-derived malware,”

wrote Lin in the analysis.

Active Since July 2026

FortiGuard Labs discovered the botnet after observing exploitation attempts against a list of specific vulnerabilities, all with payload callbacks pointing to the same loader URL at 91.92.40[.]118/wget.sh. The researcher assessed that the botnet has been actively targeting internet-facing devices since July 2026, exploiting multiple vulnerabilities across diverse regions.

• CVE-2007-3010: Alcatel OmniPCX Enterprise remote code execution (RCE) vulnerability
• CVE-2016-6277: NETGEAR Multiple Routers RCE vulnerability
• CVE-2018-14558: Tenda AC7, AC9 and AC10 Routers command injection vulnerability
• CVE-2019-14931: Mitsubishi Electric Europe B.V. ME-RTU devices and INEA ME-RTU devices remote command injection vulnerability
• CVE-2020-10987: Tenda AC1900 Router AC15 Model RCE vulnerability
• CVE-2021-46422: Telesquare SDT-CW3B1 command injection vulnerability
• CVE-2022-37055: D-Link Routers buffer overflow vulnerability
• CVE-2024-29269: Telesquare TLR-2005KSH command injection vulnerability
• CVE-2025-10123: D-Link DIR-823X command injection vulnerability
• CVE-2025-55583: D-Link DIR-868L B1 router command injection vulnerability

The breadth of vulnerabilities targeted indicates the botnet is indiscriminate, going after a variety of vendors and device types. The inclusion of an integrated exploit arsenal that targets multiple known vulnerabilities across IoT devices, networking equipment, and enterprise applications suggests a deliberate effort to maximize the range of devices that can be compromised.

From Mirai's Ashes

Mirai, the notorious malware strain that Evooo1Bot builds upon, first appeared in 2016. It infects IoT devices using default credentials, turning them into a massive network of bots for DDoS attacks. The source code was publicly leaked in September 2016 on Hack Forums by a user named 'Anna-senpai,' later unmasked by the FBI as college student Paras Jha along with co-creators Josiah White and Dalton Norman.

Originally built to target Minecraft servers and sell DDoS-protection services, the creators released the code to flood the web with noise and obscure their identities as law enforcement closed in. That leak inadvertently spawned countless modern malware variants that continue to reuse Mirai's DDoS engine today.

Evooo1Bot is a clear example of how attackers continue to build on that legacy, but with a more sophisticated toolkit. The shift from simple DDoS to operations that include proxying and credential theft marks a notable evolution in the threat landscape.

Why It Matters

For businesses and consumers alike, the emergence of Evooo1Bot underscores the risk posed by unpatched edge devices. Routers and other networking gear are often left unmanaged, making them easy targets for attackers. The botnet's ability to turn compromised devices into proxies means that even a seemingly low-risk device can become a foothold for deeper network intrusion.

This development suggests that attackers are increasingly viewing edge devices not just as DDoS cannon fodder, but as valuable assets for stealthy operations. The encrypted C2 and obfuscation techniques also indicate a more cautious approach, designed to evade detection and analysis. As such, the security community will need to pay closer attention to these types of threats, and organizations should consider whether their network edge devices are adequately protected against such exploitation.