--- title: Linux Botnet Evooo1Bot Expands Mirai Capabilities Beyond... description: A new Mirai-derived Linux botnet, dubbed Evooo1Bot, has been targeting Internet-facing devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare,... canonical: https://daily.dev/posts/linux-botnet-evooo1bot-expands-mirai-capabilities-beyond-ddos-2qxoupajp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Linux Botnet Evooo1Bot Expands Mirai Capabilities Beyond DDoS | daily.dev og:description: A new Mirai-derived Linux botnet, dubbed Evooo1Bot, has been targeting Internet-facing devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare,... og:url: https://daily.dev/posts/linux-botnet-evooo1bot-expands-mirai-capabilities-beyond-ddos-2qxoupajp og:image: https://api.daily.dev/og/posts/2QxoUpaJP.png og:image:alt: Linux Botnet Evooo1Bot Expands Mirai Capabilities Beyond DDoS og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Linux Botnet Evooo1Bot Expands Mirai Capabilities Beyond DDoS **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary A new Mirai-derived Linux botnet, dubbed Evooo1Bot, has been targeting Internet-facing devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link since at least July by exploiting long-known vulnerabilities dating back to 2007. Unlike typical Mirai spinoffs focused solely on DDoS, it adds encrypted C2 over TCP port 442, an SSH brute-force scanner, a credential sniffer, sandbox/honeypot detection, and a reverse SOCKS relay module that turns compromised devices into persistent proxy infrastructure attackers can use to hide their origin and pivot into internal networks. Fortiguard Labs researchers call the SOCKS relay capability the most operationally significant addition, signaling growing professionalization of botnet development. Defenders are urged to patch or replace legacy edge devices, watch for unauthorized cron jobs and systemd services, and monitor for unexpected SOCKS/proxy behavior. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What makes the Evooo1Bot botnet different from a typical Mirai-based DDoS botnet? Evooo1Bot extends the leaked Mirai DDoS engine with a modular framework that includes encrypted command-and-control over TCP port 442, an SSH brute-force scanner, a credential sniffer, an integrated exploit arsenal, and a reverse SOCKS relay module. The SOCKS relay is considered the most significant addition since it turns compromised routers, cameras, or firewalls into persistent proxies attackers use to hide their origin and pivot into internal networks. _Track evolving botnet tactics like these on daily.dev to keep edge-device defenses current._ ### Which vulnerabilities does the Evooo1Bot botnet exploit to compromise devices? Evooo1Bot exploits a range of unpatched command injection and remote code execution flaws in edge devices, including CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, and CVE-2020-10987, affecting equipment from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link. Some of these vulnerabilities date back nearly two decades, showing attackers rely on forgotten, unpatched devices rather than novel exploits. _Developers securing IoT fleets can follow disclosed CVEs like these on daily.dev._ ### How can defenders detect if a device is compromised by Evooo1Bot or a similar Mirai-derived botnet? Look for unauthorized cron jobs, systemd services, init scripts, and shell-profile modifications, investigate unexplained SSH authentication attempts against network infrastructure, and monitor for devices unexpectedly behaving as SOCKS or proxy endpoints. Evooo1Bot also detects analysis tools, virtualized environments, and honeypots before executing, so standard sandbox analysis may miss it. _Security teams hardening edge devices can stay ahead of botnet techniques via daily.dev._ ## Similar posts on daily.dev - [A Chinese state-linked botnet has grown to 1,500 hacked routers and is mapping vulnerable targets within hours of disclosure](https://daily.dev/posts/a-chinese-state-linked-botnet-has-grown-to-1-500-hacked-routers-and-is-mapping-vulnerable-targets-wi-xqb8rcet8) · The Next Web · 0 upvotes · 0 comments - [C0XMO botnet spreads via DD-WRT router flaw, kills rival malware](https://daily.dev/posts/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware-h3aopvaei) · BleepingComputer · 0 upvotes · 0 comments - [Kimwolf v7: An Evolution of the Kimwolf Botnet](https://daily.dev/posts/kimwolf-v7-an-evolution-of-the-kimwolf-botnet-qyisegkoc) · Unit 42 · 0 upvotes · 0 comments - [SSHStalker botnet brute-forces its way onto 7,000 Linux machines](https://daily.dev/posts/sshstalker-botnet-brute-forces-its-way-onto-7-000-linux-machines-d1nrvsgyf) · CSO Online · 14 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/linux-botnet-evooo1bot-expands-mirai-capabilities-beyond-ddos-2qxoupajp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Linux Botnet Evooo1Bot Expands Mirai Capabilities Beyond DDoS","url":"https://daily.dev/posts/linux-botnet-evooo1bot-expands-mirai-capabilities-beyond-ddos-2qxoupajp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/linux-botnet-evooo1bot-expands-mirai-capabilities-beyond-ddos-2qxoupajp"},"datePublished":"2026-08-17T16:12:11.715Z","dateModified":"2026-08-17T16:13:35.341Z","description":"A new Mirai-derived Linux botnet, dubbed Evooo1Bot, has been targeting Internet-facing devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3770904700e4041d937f923611096600?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3770904700e4041d937f923611096600?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/linux-botnet-evooo1bot-expands-mirai-capabilities-beyond-ddos-2qxoupajp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Linux Botnet Evooo1Bot Expands Mirai Capabilities Beyond DDoS"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/linux-botnet-evooo1bot-expands-mirai-capabilities-beyond-ddos-2qxoupajp#faq","mainEntity":[{"@type":"Question","name":"What makes the Evooo1Bot botnet different from a typical Mirai-based DDoS botnet?","acceptedAnswer":{"@type":"Answer","text":"Evooo1Bot extends the leaked Mirai DDoS engine with a modular framework that includes encrypted command-and-control over TCP port 442, an SSH brute-force scanner, a credential sniffer, an integrated exploit arsenal, and a reverse SOCKS relay module. The SOCKS relay is considered the most significant addition since it turns compromised routers, cameras, or firewalls into persistent proxies attackers use to hide their origin and pivot into internal networks. Track evolving botnet tactics like these on daily.dev to keep edge-device defenses current."}},{"@type":"Question","name":"Which vulnerabilities does the Evooo1Bot botnet exploit to compromise devices?","acceptedAnswer":{"@type":"Answer","text":"Evooo1Bot exploits a range of unpatched command injection and remote code execution flaws in edge devices, including CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, and CVE-2020-10987, affecting equipment from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link. Some of these vulnerabilities date back nearly two decades, showing attackers rely on forgotten, unpatched devices rather than novel exploits. Developers securing IoT fleets can follow disclosed CVEs like these on daily.dev."}},{"@type":"Question","name":"How can defenders detect if a device is compromised by Evooo1Bot or a similar Mirai-derived botnet?","acceptedAnswer":{"@type":"Answer","text":"Look for unauthorized cron jobs, systemd services, init scripts, and shell-profile modifications, investigate unexplained SSH authentication attempts against network infrastructure, and monitor for devices unexpectedly behaving as SOCKS or proxy endpoints. Evooo1Bot also detects analysis tools, virtualized environments, and honeypots before executing, so standard sandbox analysis may miss it. Security teams hardening edge devices can stay ahead of botnet techniques via daily.dev."}}]} ```