Evooo1Bot Turns Linux Gateways into SOCKS5 Relays for Attacks and Credential Theft

A New Botnet Targets Exposed Devices

Evooo1Bot is a modular Linux botnet derived from Mirai. It has been observed since at least July and was reported on August 15, 2026. The operation targets Internet-accessible gateway devices, turning them into SOCKS5 traffic relays and launchpads for further attacks.

The affected devices come from at least six manufacturers: Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link. The exact vulnerable product versions have not been disclosed.

The infection exploits known vulnerabilities in exposed devices. Recent Evooo1Bot versions also include modules targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installations.

Not all exploits appear to work correctly. Fortinet reports that some were implemented incorrectly and therefore do not result in successful compromise. When an attack succeeds, the device downloads malware compatible with its architecture.

Twelve Builds and a Persistence Chain

Evooo1Bot has 12 different builds. The sample selects the one suited to the compromised device’s CPU, increasing the likelihood of execution across heterogeneous gateway hardware.

Before starting, the malware searches for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots. The goal is to reduce the risk of analysis and prevent the infection from being observed in controlled environments.

Persistence can be configured through several Linux mechanisms:

• systemd services;
• SysV init scripts;
• shell profiles;
• rc.local;
• cron jobs.

The cron job attempts to download the payload again every five minutes. This behavior can allow the malware to recover after the main process is removed or after only partial remediation.

After completing the infection, Evooo1Bot deletes the Bash history. This reduces the traces left by commands executed during device access and configuration.

Infrastructure for Proxies, DDoS, and Unauthorized Access

The botnet retains the DDoS attack engine derived from Mirai’s leaked source code, while adding broader capabilities.

Communications with the command-and-control infrastructure are encrypted over port 443. The malware also provides an interactive shell, file upload and download commands, and an SSH scanner that attempts access using 150 username-and-password combinations focused on corporate accounts.

After a successful SSH login, the code performs checks to avoid honeypots. The botnet therefore does not rely solely on automated vulnerability exploitation: it can also spread through weak or reused credentials.

The SOCKS5 component operates in two modes:

• direct listening on the compromised device;
• reverse relay to the attacker’s infrastructure.

Proxy sessions are independent and can run concurrently. An infected device can therefore forward traffic, conceal the origin of malicious activity, bypass geographic restrictions, or facilitate access to networks reachable through the gateway.

Fortinet believes that significant botnet growth could support residential proxy services. In this scenario, compromised business or home devices would become part of a monetized network for traffic forwarding.

The DDoS module supports 16 flooding techniques, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and HTTP. HTTP requests can be customized, allowing attackers to tailor campaigns to their targets.

The Risk to Credentials and Internal Networks

Evooo1Bot includes a credential-sniffing module that monitors /proc/net/tcp. The component looks for HTTP Basic Authentication headers and cookies transmitted over observed connections.

The risk therefore extends beyond bandwidth consumption or using the device as a relay. Captured credentials may enable further access to administrative panels, internal applications, or other systems where passwords have been reused.

A compromised gateway can also become a launch point for attacks against networks that are not normally exposed directly to the Internet. The reverse-relay function makes it easier to use the device as an intermediary.

The source does not assign Evooo1Bot a numerical severity score. Its operational risk is nevertheless high: the same device can be used simultaneously for SSH brute-force attacks, credential theft, DDoS campaigns, and traffic concealment.

Persistence and payload re-downloads every five minutes complicate incomplete remediation. Rebooting the device or terminating a single process may not be sufficient.

What Administrators Should Do

The first step is to update the firmware of affected devices whenever the manufacturer still provides fixes. Specific vulnerable versions have not been disclosed, so administrators should review security advisories for the installed model, not just the brand.

They should also:

• replace default administrative credentials;
• use unique, strong passwords;
• disable nonessential remote management panels;
• restrict administration to authorized networks or addresses;
• replace devices that are no longer supported by the manufacturer.

During analysis, look for unexpected processes or services and changes to systemd, SysV init, rc.local, shell profiles, and crontabs. Repeated download activity at five-minute intervals and unusual encrypted connections over port 443 deserve particular attention.

Administrators should also check for:

• unexpected SOCKS5 traffic;
• outbound SSH connections to numerous addresses;
• repeated authentication attempts;
• DDoS traffic generated by the gateway;
• access to files or configurations containing credentials;
• potentially exposed cookies or Basic Authentication headers.

If a compromise is confirmed, the device should be isolated from the network, examined, and restored using trusted firmware. After remediation, administrators should rotate administrative credentials and any credentials that may have passed through the device.

It is not known whether Evooo1Bot is listed in CISA’s KEV Catalog, and no listing date or mitigation deadline is available. No recent entries involving the same manufacturer are listed either.

Valid Credentials Remain a Weak Point

Additional context comes from The Blue Report 2026, which is based on 338 million simulations in customers’ production environments. According to the report, when an attacker has valid credentials, they are blocked in only 37% of actions.

This figure does not directly measure Evooo1Bot, but it helps illustrate the risk posed by its sniffing module and SSH scanner. Gateway protection cannot stop at exploit detection: it must also include strong authentication, network segmentation, and monitoring of access attempts following the initial compromise.