Do Son 
At a glance
- Malware family: Evooo1Bot
- Threat actor: Unknown
- Target or victims: Internet-facing devices, routers, firewalls, and IP cameras globally
- Delivery vector: Exploitation of known CVEs and SSH brute force
- Key capabilities: Encrypted C2, SOCKS5 relay, SSH scanner, DDoS, credential sniffing
- Source: FortiGuard Labs
TL;DR
FortiGuard Labs recently uncovered the Evooo1Bot Linux botnet. While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities. Specifically, this new threat turns compromised hardware into hidden proxy nodes.
Delivery
Attackers actively exploit multiple known vulnerabilities to distribute the payload. Currently, they target edge devices from brands like Netgear, D-Link, and Alcatel. Security sensors detect these exploitation attempts frequently across public internet traffic. The delivery process begins with a malicious loader script named wget.sh. Operators embed campaign labels into the download commands to track their infection success rates. For instance, the label “mitsu” tracks Mitsubishi targets, while “rep.alcatel” tracks Alcatel-Lucent devices.
Once executed, the script fetches the correct binary for the host architecture. It tries downloading via wget, busybox, curl, and tftp in sequence. After that, the malware clears the Bash history to hide its tracks. The infection attempts span regions including North America, Europe, Asia, and South America.
Infection chain
When the Evooo1Bot Linux botnet launches, it runs several anti-analysis checks. First, it searches for debugging tools like Wireshark, Strace, and Ghidra on the filesystem. Next, the binary inspects running processes and virtual machine environments. It looks for indicators of sandboxes like Cuckoo, FireEye, and AnyRun. If the environment appears safe, the malware decrypts its internal strings. The developers use a multi-layer pipeline combining AES-256-CTR, ChaCha20, and XOR encryption.
Following decryption, the program installs multiple persistence mechanisms simultaneously. It sets up a systemd service disguised as an Apache HTTPD Cache Manager. Furthermore, the malware adds a scheduled cron job that runs every five minutes. It also injects itself into shell profiles and the rc.local file. To resist removal, the binary modifies its out-of-memory score to evade the Linux OOM-killer. Finally, it keeps the device watchdog open to prevent unexpected system reboots.
Command-and-control and data-exfiltration behaviour
After securing persistence, the bot connects to its command-and-control server over port 443. This port selection helps the malicious traffic blend in with normal HTTPS web requests. The botnet features a highly capable reverse SOCKS5 relay module. “By transforming a compromised router, firewall, IP camera, or other edge device into a persistent proxy, the malware enables attackers to conceal their true origin, pivot into internal networks, and conduct follow-on operations through the victim’s infrastructure,” the report explains. This proxy function supports both direct listening and reverse encrypted connections.
Additionally, the malware contains a built-in SSH scanner. Before launching attacks, the scanner checks the target SSH banner against a hardcoded honeypot list. It bypasses security tools like Cowrie and Kippo quietly without logging. If the target passes these checks, the bot brute-forces access using an embedded credential dictionary. The dictionary includes default IoT passwords and enterprise service accounts like Jenkins and Postgres. The malware also features an advanced DDoS engine supporting 16 different attack methods, including GRE and UDP floods. Furthermore, a credential sniffer intercepts HTTP Basic Authorization headers.
Defense or detection guidance
Defending against this threat requires proactive patch management. Organizations must apply firmware updates to all internet-facing hardware immediately. Security teams should monitor edge devices for unexpected outbound connections over port 443. Analysts must investigate any SOCKS proxy traffic originating from network perimeters.
Network administrators must replace default IoT credentials and enforce strong passwords. Disabling external SSH access reduces the risk of brute-force attacks significantly. Analysts should watch for unusual scheduled tasks or new systemd services on Linux hosts. Look for unauthorized wget or curl commands executing directly into a shell. Finally, isolate critical internal systems from consumer-grade edge devices to prevent lateral network pivoting.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
