-
Cybersecurity researchers have discovered a new Linux botnet called Evooo1Bot that turns internet-facing devices into secret proxy nodes for attackers.
-
The malware exploits at least ten known security flaws in popular routers and edge devices, and has been active since July 2026.
-
Once inside a device, Evooo1Bot can steal login credentials, launch attacks, and disguise criminal traffic through the victim’s own internet connection.
Security researchers at Fortinet FortiGuard Labs have uncovered a new and dangerous botnet targeting Linux-based devices. They are calling it Evooo1Bot. The botnet has been active in the wild since July 2026. It targets routers, cameras, and other devices connected to the internet.
Evooo1Bot borrows its attack engine from Mirai, a well-known botnet whose source code leaked to the public years ago. But this one goes much further than Mirai ever did. According to Fortinet FortiGuard Labs, the malware adds encrypted communications, a password-guessing tool for SSH connections, a credential sniffer, a traffic relay module, and a built-in library of exploits for known security flaws.
How Evooo1Bot Gets in
The botnet gets into devices by exploiting known security vulnerabilities. Researchers identified ten flaws it actively uses. These include weaknesses in NETGEAR routers (CVE-2016-6277), Tenda routers (CVE-2018-14558), D-Link routers (CVE-2022-37055), and even a flaw dating back to 2007 in Alcatel OmniPCX systems (CVE-2007-3010). Two of the flaws, CVE-2025-10123 and CVE-2025-55583, affect D-Link devices and were only discovered this year.
When the botnet successfully exploits a device, it runs a shell script called “wget.sh” from an outside server. That script downloads the main malware file built to match the device’s processor type. It then wipes the device’s command history to erase any sign of the attack.
After the malware runs, it checks whether it is inside a security testing environment or sandbox. If the coast is clear, it connects to its command-and-control (C2) server using port 443. That port normally handles secure web traffic, so the malware blends right in with everyday internet activity. The infected device then waits quietly for instructions.
What the Malware can do
Evooo1Bot gives its operators a wide set of tools once a device is under their control. They can install the malware permanently on the device, update it remotely, or shut it down. They can also upload and download files, open a live command shell, and intercept login credentials from web traffic.
The malware also carries a separate exploit module that targets eight more security flaws. These affect products from Hikvision (CVE-2021-36260), Atlassian Confluence (CVE-2022-26134), TP-Link (CVE-2023-1389), PHP (CVE-2024-4577), and Kubernetes (CVE-2025-1974), among others. It can also launch floods of traffic (DDoS attacks) over TCP, UDP, and DNS connections.
Turning Victims into Cover
The most concerning feature is the SOCKS5 proxy module. This tool quietly turns an infected router, camera, or firewall into a relay point for the attacker’s traffic. In simple terms, the attacker routes their activity through the victim’s device. To the outside world, the traffic looks like it is coming from the victim, not the hacker.
According to Fortinet, this feature makes each infected device far more valuable to attackers. The victim’s internet address can hide malicious traffic, get around location-based restrictions, or provide a way into private networks through a machine that is already compromised.
Fortinet also noted that in larger botnets, this same feature could build a spread-out network of proxy devices. Attackers could use that network for anonymous traffic forwarding or even sell access through residential and business proxy services.
Evooo1Bot is a sharp reminder that old, unpatched devices are low-hanging fruit for attackers. Keeping device firmware updated and replacing end-of-life hardware remains the most direct line of defense.
The KadNap botnet reinforces the same lesson. Since August 2025, it has infected over 14,000 edge devices, mostly Asus routers, by exploiting similar weaknesses. Its use of a peer-to-peer network makes it especially difficult to detect and disrupt.
