[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQoTb36Wo-KfdHMCmP-uFxIvQANARoHtHClQ3-4caHgQ":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":29,"category":30,"article_tags":34},"d8cb1118-98b0-4fa4-9668-6a17e829b84b","Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies","evooo1bot-linux-botnet-exploits-known-flaws-to-turn-edge-devices-into-socks5-pro-7637e9","Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. \"While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including","A new Linux botnet family, Evooo1Bot, has been discovered, building upon the Mirai botnet's source code. It exploits known vulnerabilities in internet-facing devices to deliver its payload, turning compromised devices into SOCKS proxies. The botnet also features encrypted C2 communications, an SSH brute-force scanner, and an exploit arsenal targeting various known flaws.","New Linux botnet Evooo1Bot leverages Mirai code to turn edge devices into SOCKS proxies.","Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies Ravie LakshmananAug 17, 2026Malware \u002F Botnet Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. \"While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities,\" Fortinet FortiGuard Labs said. Evidence indicates that the botnet has been active in the wild since July 2026, exploiting known vulnerabilities in publicly-accessible devices to deliver the malware. Some of the security flaws weaponized by the botnet are below - CVE-2007-3010 - Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability CVE-2016-6277 - NETGEAR Multiple Routers Remote Code Execution Vulnerability CVE-2018-14558 - Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability CVE-2019-14931 - Mitsubishi Electric Europe B.V. ME-RTU devices and INEA ME-RTU devices remote Command Injection vulnerability CVE-2020-10987 - Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability CVE-2021-46422 - Telesquare SDT-CW3B1 Command Injection vulnerability CVE-2022-37055 - D-Link Routers Buffer Overflow Vulnerability CVE-2024-29269 - Telesquare TLR-2005KSH Command Injection Vulnerability CVE-2025-10123 - D-Link DIR-823X Command Injection Vulnerability CVE-2025-55583 - D-Link DIR-868L B1 router Command Injection Vulnerability Successful exploitation leads to the execution of a loader shell script (\"wget.sh\") hosted on an external server (\"91.92.40[.]118\"), which then retrieves the botnet binary that's compatible with the device CPU architecture. The script subsequently clears Bash history to erase traces of the attack. Upon execution, the binary checks for the presence of analysis tools, sandboxes, and virtual environments, before establishing encrypted communications with a command-and-control (C2) server on port 443. The port choice is intentional as it allows the malware to blend in with expected HTTPS traffic at the network perimeter. Once the host is registered with the C2 server, it waits for further commands to take action. It supports a number of commands that allow an operator to install persistence mechanisms, update the binary, terminate the bot, upload\u002Fdownload files, launch an interactive shell, intercept HTTP Basic Authorization and Cookie headers, turn the host into a proxy node, launch an SSH brute-force scanner, trigger DDoS attacks over DNS, TCP, and UDP, and fire an HTTP-based exploit dispatcher for exploiting known flaws. The CVE attack module includes the ability to launch exploits for eight security flaws impacting Hikvision (CVE-2021-36260), Atlassian Confluence (CVE-2022-26134), WSO2 (CVE-2022-29464), Zyxel (CVE-2022-30525), TP-Link (CVE-2023-1389), PHP (CVE-2024-4577), D-Link (CVE-2024-10914), Kubernetes (CVE-2025-1974). The proxy component, on the other hand, transforms an infected router, firewall, IP camera, or other edge device into a SOCKS5 proxy that the threat actor can leverage as a network relay to conduct follow-on operations and evade detection. \"This capability significantly increases the value of an infected host to attackers,\" Fortinet said. \"The victim's IP address can be used to disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine.\" \"In larger botnets, the same functionality could also be used to build a distributed proxy infrastructure, enabling anonymous traffic forwarding or monetization through residential and enterprise proxy services.\" Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  botnet, Credential Theft, ddos, iot security, Linux security, Malware, network security, router security, Threat Intelligence, Vulnerability ⚡ Top Stories This Week Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers ⭐ Featured Resources See How to Stop the Browser-Based Attacks Your Existing Stack Misses [Book a Live Demo] [Webinar] See Where Claude Fits in the SOC and Where It Falls Short at Scale Defend Against One-Click AI Memory Poisoning — Download the Cheat Sheet Benchmark Your Defenses Against 338M+ Attack Simulations — Download the Blue Report 2026","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fevooo1bot-linux-botnet-exploits-known.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhIDrkyaW1magTuvTfLfkhtk_8stt1zYUxgonTZX1yaI_OGxsGMV9wCRE8bglbRubclVma7bkghEbmah6ku4T2ZVnpSngl6k5Cw0iCXgNNpuy6I2ZNPQOYYIfqKNgcVQxkqZdgvFLLM82bK1By0hrAm4i9slLnFQwQmwLmpR8I9eb8Paze2sf2UJMlol81Q\u002Fs1600\u002Flinux-botnet.jpg","2026-08-17T09:29:55+00:00","2026-08-17T12:00:17.222361+00:00",8,[18,21,24,27],{"name":19,"type":20},"Fortinet","vendor",{"name":22,"type":23},"FortiGuard Labs","product",{"name":25,"type":26},"SOCKS5 proxy","technology",{"name":28,"type":26},"DDoS","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,56,59,62,65,68,71,74,77,80,83,86,89,92,95,98,101,104],{"type":49,"value":50,"context":51},"ip","91.92.40.118","IP address hosting the initial loader shell script (wget.sh).",{"type":53,"value":54,"context":55},"cve","CVE-2007-3010","Exploited vulnerability in Alcatel OmniPCX Enterprise.",{"type":53,"value":57,"context":58},"CVE-2016-6277","Exploited vulnerability in NETGEAR Multiple Routers.",{"type":53,"value":60,"context":61},"CVE-2018-14558","Exploited vulnerability in Tenda AC7, AC9, and AC10 Routers.",{"type":53,"value":63,"context":64},"CVE-2019-14931","Exploited vulnerability in Mitsubishi Electric ME-RTU devices.",{"type":53,"value":66,"context":67},"CVE-2020-10987","Exploited vulnerability in Tenda AC15 Router.",{"type":53,"value":69,"context":70},"CVE-2021-46422","Exploited vulnerability in Telesquare SDT-CW3B1.",{"type":53,"value":72,"context":73},"CVE-2022-37055","Exploited vulnerability in D-Link Routers.",{"type":53,"value":75,"context":76},"CVE-2024-29269","Exploited vulnerability in Telesquare TLR-2005KSH.",{"type":53,"value":78,"context":79},"CVE-2025-10123","Exploited vulnerability in D-Link DIR-823X.",{"type":53,"value":81,"context":82},"CVE-2025-55583","Exploited vulnerability in D-Link DIR-868L B1 router.",{"type":53,"value":84,"context":85},"CVE-2021-36260","Exploited vulnerability in Hikvision devices.",{"type":53,"value":87,"context":88},"CVE-2022-26134","Exploited vulnerability in Atlassian Confluence.",{"type":53,"value":90,"context":91},"CVE-2022-29464","Exploited vulnerability in WSO2.",{"type":53,"value":93,"context":94},"CVE-2022-30525","Exploited vulnerability in Zyxel devices.",{"type":53,"value":96,"context":97},"CVE-2023-1389","Exploited vulnerability in TP-Link devices.",{"type":53,"value":99,"context":100},"CVE-2024-4577","Exploited vulnerability in PHP.",{"type":53,"value":102,"context":103},"CVE-2024-10914","Exploited vulnerability in D-Link devices.",{"type":53,"value":105,"context":106},"CVE-2025-1974","Exploited vulnerability in Kubernetes."]