Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies

Cybersecurity researchers have uncovered a previously undocumented Linux botnet family named Evooo1Bot, which is derived from the Mirai botnet source code and is designed to convert internet-facing devices into SOCKS5 proxies. According to Fortinet FortiGuard Labs, the malware reuses Mirai’s DDoS engine but extends it with encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities.

Active since July 2026, Evooo1Bot exploits a range of known flaws in devices from vendors such as Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link. The initial infection vector involves a loader shell script (wget.sh) hosted on an external server, which retrieves the botnet binary compatible with the device’s CPU architecture. The script also clears Bash history to evade detection.

Once executed, the binary checks for analysis tools, sandboxes, and virtual environments before establishing encrypted communications with a C2 server on port 443, blending in with HTTPS traffic. The bot supports commands for persistence, updates, file transfer, interactive shell, credential interception, proxy activation, SSH brute-forcing, DDoS attacks, and an HTTP-based exploit dispatcher.

The CVE attack module includes exploits for eight additional flaws affecting Hikvision, Atlassian Confluence, WSO2, Zyxel, TP-Link, PHP, D-Link, and Kubernetes. The proxy component transforms infected routers, firewalls, IP cameras, or other edge devices into SOCKS5 proxies, enabling threat actors to relay malicious traffic, bypass geographic restrictions, or access internal networks. Fortinet warns that this capability significantly increases the value of infected hosts, potentially enabling large-scale proxy infrastructures for anonymous traffic forwarding or monetization.