Evooo1Bot Linux Botnet Converts Edge Routers into SOCKS5 Proxy Relays

A newly identified Linux malware threat named Evooo1Bot is actively compromising internet-facing edge routers and gateway devices, turning them into SOCKS5 traffic relay nodes and multi-purpose attack platforms. Active since at least July, the Mirai-based botnet builds upon traditional IoT denial-of-service malware by integrating credential sniffing, automated vulnerability exploitation, SSH brute-forcing, and residential proxying capabilities.

First analyzed by security researchers at Fortinet, Evooo1Bot targets a wide spectrum of embedded hardware and enterprise software. Affected vendor platforms include consumer and small-office devices from NETGEAR, Tenda, D-Link, TP-Link, and Telesquare, alongside industrial and enterprise solutions from Mitsubishi Electric, Alcatel, Hikvision, Zyxel, Atlassian Confluence, WSO2, and Kubernetes ingress-nginx.

Anatomy of the Evooo1Bot Linux Botnet

Evooo1Bot represents a distinct shift in how botnet operators monetize compromised network infrastructure. While legacy IoT botnets focused almost exclusively on accumulating bandwidth for distributed denial-of-service (DDoS) campaigns, modern operators increasingly prioritize proxy monetization. By embedding a modular SOCKS5 relay engine, Evooo1Bot allows its operators to route third-party traffic through compromised residential and commercial edge devices.

The SOCKS5 module operates in both direct listening and reverse-relay modes. Reverse relaying is particularly effective for bypassing stateful firewalls and Network Address Translation (NAT) barriers: the infected edge router initiates an outbound connection back to the attacker’s command-and-control (C2) server, creating a persistent tunnel through which external malicious traffic can be proxied. Because these sessions run independently and concurrently, operators can sell access to these nodes via residential proxy marketplaces. This enables cybercriminals to hide behind clean IP addresses, bypass geo-blocking controls, and conduct credential stuffing or web scraping without triggering IP-based rate limiting.

In addition to proxying, Evooo1Bot includes a local credential sniffer. On Linux systems, the malware monitors /proc/net/tcp to inspect active network sockets. It parses unencrypted web traffic traversing the device, attempting to harvest HTTP Basic Authentication headers and HTTP session cookies. This allows the botnet to steal administrative credentials or active session tokens directly from local management interfaces or passing transit traffic.

Exploit Delivery, Anti-Analysis, and Persistence

To compromise target systems, Evooo1Bot deploys an integrated exploit suite targeting known, unpatched vulnerabilities across multiple edge architectures and web frameworks. Newer variants include explicit exploit modules aimed at Hikvision IP cameras, Zyxel security appliances, TP-Link routers, D-Link network-attached storage (NAS) units, Atlassian Confluence servers, WSO2 middleware, Kubernetes ingress-nginx controllers, and flawed PHP-CGI installations. Fortinet noted that several embedded exploit routines suffer from implementation errors causing failed execution, but successful exploits trigger a shell script that downloads a matching architecture payload.

The malware distribution server hosts 12 distinct architecture builds—covering common embedded instruction sets such as ARM, MIPS, x86, and x86_64. Once executed, the initial dropper wipes the local Bash history to obstruct post-incident forensic recovery.

Before establishing operational routines, Evooo1Bot executes comprehensive anti-analysis checks. The binary inspects the host environment for active debuggers, security monitoring tools, sandboxes, virtual machines, containers, and honeypots. If these checks pass, the malware establishes encrypted C2 communications using TLS over TCP port 443, helping its control traffic blend into standard HTTPS web browsing.

Persistence mechanisms are redundant and aggressive. Evooo1Bot hooks into multiple Linux initialization frameworks, including systemd service files, SysV init scripts, user shell profiles (.bashrc), and /etc/rc.local. Furthermore, it installs a system cron job configured to re-download and execute the payload every five minutes, ensuring recovery even if a running malware process is terminated by an administrator.

SSH Brute-Forcing and Mirai DDoS Capabilities

For devices not susceptible to its web exploit payload arsenal, Evooo1Bot incorporates an automated SSH scanning module. The scanner cycles through a targeted dictionary of 150 credential pairs specifically compiled for enterprise equipment, network gateways, and IoT admin accounts. To avoid falling into high-interaction deception environments, the SSH module performs post-login fingerprinting checks; if it detects honeypot characteristics, it immediately drops the session without deploying its payload.

When commanded to perform denial-of-service operations, Evooo1Bot relies on a customized engine derived from the publicly leaked Mirai source code. The botnet supports 16 distinct flood vectors:

• Layer 4 volumetric attacks, including UDP, TCP SYN, TCP ACK, GRE, and fragmented TCP floods.
• Layer 7 application attacks, including customizable HTTP GET/POST floods capable of impersonating legitimate user-agent strings and headers.
• Protocol amplification vectors, such as DNS reflection floods.

Blast Radius and Infrastructure Defense

Edge gateway devices—such as small office/home office (SOHO) routers, VPN concentrators, and firewalls—are prime targets for malware like Evooo1Bot because they sit outside the perimeter of internal Endpoint Detection and Response (EDR) agents. Once an attacker establishes a presence on an unmonitored edge device, the realistic blast radius includes full network exposure: the gateway can be used as a beachhead for lateral movement, a passive credential sniffer for internal traffic, or an anonymizing proxy for secondary attacks against external organizations.

Mitigating threats from modular router botnets requires hardening the network edge:

• Apply Firmware Patches: Prioritize patching internet-facing appliances, particularly Zyxel, D-Link, NETGEAR, Hikvision, and TP-Link hardware, against known remote code execution (RCE) flaws.
• Disable Remote Management: Turn off WAN-side administrative interfaces (HTTP, HTTPS, SSH, and TELNET). Management panels should only be reachable via dedicated out-of-band networks or encrypted management VPNs.
• Credential Hygiene: Replace default manufacturer credentials with strong, unique passwords across all network management interfaces and SSH service endpoints.
• Monitor Egress Traffic: Inspect outbound network connections originating from edge devices. Alert on unexpected outbound TLS sessions on port 443 to unfamiliar IP addresses or unauthorized cron job creation on Linux-based appliances.
• Decommission End-of-Life (EoL) Hardware: Legacy routing hardware no longer receiving vendor security updates must be retired, as unpatched vulnerabilities leave these devices permanently vulnerable to automated botnet recruitment.