Ботнет Evooo1Bot превращает зараженные устройства в прокси

Fortinet researchers have identified a new Linux-based botnet named Evooo1Bot, built upon Mirai source code, which has been active since at least July 2026. The malware specifically targets internet-exposed edge devices such as routers, firewalls, and IP cameras, leveraging various vulnerabilities including CVE-2025-10123, CVE-2024-29269, and CVE-2024-4577 to compromise systems from vendors like Alcatel, Netgear, Tenda, Mitsubishi Electric, Telesquare, D-Link, Hikvision, Atlassian Confluence, WSO2, Zyxel, and TP-Link. Once installed, Evooo1Bot transforms these devices into SOCKS5 proxies and utilizes modules for credential theft, SSH brute-forcing, and DDoS attacks.

The threat is significant because the botnet infrastructure can obscure malicious traffic, bypass geographic restrictions, facilitate lateral movement within compromised networks, and monetize access through proxy services. To maintain persistence, the malware employs systemd, SysV init, and cron jobs, while simultaneously scanning for security countermeasures before establishing encrypted command-and-control channels over port 443.