Evooo1Bot: A New Linux Botnet Turns Routers into Proxy Nodes

Fortinet researchers have detailed a new Linux malware family called Evooo1Bot. The modular botnet targets internet-facing network equipment and turns infected devices into nodes for relaying traffic over the SOCKS5 protocol.

Since at least July, Evooo1Bot has been infecting devices made by Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link across various regions, exploiting known vulnerabilities. The malware's capabilities go beyond proxying: it can steal credentials, brute-force SSH passwords and carry out DDoS attacks.

A Mirai legacy with new add-ons

Evooo1Bot borrowed its DDoS engine from previously leaked Mirai source code, but substantially expanded the original design. Added to it are an encrypted command channel, a scanner for brute-forcing SSH passwords, a SOCKS relay module, a credential interceptor and a whole arsenal of exploits targeting numerous known vulnerabilities. More recent builds introduced a separate module aimed at Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, ingress-nginx for Kubernetes and vulnerable PHP-CGI installations. That said, some of the built-in exploits are implemented incorrectly, which often causes the attacks to fail.

Upon successful exploitation, the script downloads one of 12 builds matching the host's processor architecture, then clears the Bash history to erase its tracks. Command-and-control traffic is encrypted and routed through port 443, and before launching, the malware carefully checks the system for debuggers, security tools, sandboxes, virtual machines, containers and honeypots.

Persistence and monetization

Persistence on the system is achieved through systemd, SysV init, shell profiles and rc.local, while a cron job attempts to re-download the payload every five minutes. The operator gains an interactive shell along with the ability to upload and download files. A separate interception module monitors /proc/net/tcp and tries to capture HTTP Basic Authentication and Cookie headers.

The SOCKS5 module supports both direct listening and a reverse relay mode, allowing attackers to hide malicious traffic, bypass geographic restrictions and penetrate internal networks through compromised devices. According to Fortinet, the proxy sessions operate independently of one another and can be opened simultaneously — at a sufficient botnet scale, this opens the door to profiting from residential proxy services. The SSH scanner cycles through 150 combinations of usernames and passwords geared toward corporate accounts, while the DDoS module inherited from Mirai supports 16 flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP and HTTP.

For protection, Fortinet recommends the usual set of measures: keep IoT device firmware updated in a timely manner, change default administrator credentials, disable remote access panels and replace equipment for which the manufacturer no longer releases updates.

Source: Bleeping Computer