Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies

Fortinet FortiGuard Labs identified Evooo1Bot, a newly documented Linux botnet derived from Mirai source code that has been actively compromising internet-facing devices since July 2026. The malware employs an integrated exploit arsenal targeting multiple known vulnerabilities, including CVE-2007-3010 in Alcatel OmniPCX Enterprise, CVE-2016-6277 in NETGEAR routers, and command injection flaws such as CVE-2018-14558 in Tenda AC7/AC9/AC10 models.

Beyond standard DDoS capabilities, Evooo1Bot introduces encrypted C2 communication over port 443, credential sniffing, and a distinct feature that converts infected hosts into SOCKS5 proxies. This infrastructure allows threat actors to route malicious traffic through compromised edge devices, effectively using victim IPs to mask their origin and access internal networks.