FortiGuard Labs documents a newly discovered Linux botnet dubbed Evooo1Bot, which extends the leaked Mirai DDoS engine with encrypted C2 communications, an SSH brute-force scanner with honeypot detection, a reverse SOCKS5 relay module, a credential sniffer, and an integrated exploit arsenal covering ten actively-exploited CVEs plus eight additional CVE payload entries (some non-functional). Active since July 2026, it targets IoT devices, routers, and enterprise appliances across multiple regions, using a loader script served from a hardcoded IP that fetches architecture-matched binaries. The malware employs multi-layer string obfuscation (AES-256-CTR, ChaCha20, XOR) and extensive anti-analysis/anti-sandbox checks, and installs five persistence mechanisms simultaneously. Fortinet provides detection signatures, IPS rules, and IOCs, and recommends prompt patching of Internet-facing devices.
Table of contents
DiscoveryBasic Sample IdentificationFunctional ModulesPersistence MechanismsSOCKS relaySSH Brute-ForceDDoS Attack MethodCVE Exploit ModuleConclusionFortinet ProtectionsIOCsQuestions this post answers
What is the Evooo1Bot Linux botnet and what capabilities does it have?
Evooo1Bot is a Linux botnet that extends the leaked Mirai DDoS engine with encrypted C2 communications, an SSH brute-force scanner with honeypot evasion, a SOCKS5 relay module (direct and reverse modes), a credential sniffer reading HTTP Basic Auth and Cookie headers, and a 28-command remote administration interface including a CVE exploit dispatcher. It has been active since July 2026. Track emerging botnet threats and IoT vulnerability exploitation trends on daily.dev to stay ahead of exposure risks.
Which CVEs is the Evooo1Bot botnet actively exploiting to infect devices?
Active exploitation was observed for ten CVEs including CVE-2007-3010 (Alcatel OmniPCX), CVE-2016-6277 (NETGEAR routers), CVE-2018-14558 and CVE-2020-10987 (Tenda routers), CVE-2019-14931 (Mitsubishi ME-RTU), CVE-2021-46422 and CVE-2024-29269 (Telesquare), CVE-2022-37055, CVE-2025-10123, and CVE-2025-55583 (D-Link routers), all pointing to the same loader URL at 91.92.40.118/wget.sh. Security teams patching edge devices against known CVEs can follow botnet exploitation trends via daily.dev.
How does the SSH scanner in the Evooo1Bot botnet detect and avoid honeypots?
It runs two checks before delivering payloads: a pre-authentication banner comparison against known honeypot signatures like Cowrie, Kippo, HonSSH, and Glutton, and a post-login probe that runs a shell command checking /proc/version for the string 'Linux version' and scanning for /opt/cowrie or /home/kippo directories. Only targets passing both checks, plus a valid credential from a 150+ entry dictionary, receive the persistence payload. Understanding honeypot-evasion tactics like these helps defenders on daily.dev refine SSH-facing detection strategies.