A new modular Linux botnet family based on publicly leaked source code from the Mirai botnet has been linked to exploitation attempts for several vulnerabilities in edge devices.
A Taiwan-based security researcher at Fortinet’s FortiGuard Labs, Yi Ping (Cara) Lin, shared an analysis of the new botnet family on August 13, which she called ‘Evooo1Bot’ after the hardcoded string ‘evooo1’ found in every binary.
The botnet was discovered after observed exploitation of the following vulnerabilities:
- CVE-2007-3010: Alcatel OmniPCX Enterprise remote code execution (RCE) vulnerability
- CVE-2016-6277: NETGEAR Multiple Routers RCE vulnerability
- CVE-2018-14558: Tenda AC7, AC9 and AC10 Routers command injection vulnerability
- CVE-2019-14931: Mitsubishi Electric Europe B.V. ME-RTU devices and INEA ME-RTU devices remote command injection vulnerability
- CVE-2020-10987: Tenda AC1900 Router AC15 Model RCE vulnerability
- CVE-2021-46422: Telesquare SDT-CW3B1 command injection vulnerability
- CVE-2022-37055: D-Link Routers buffer overflow vulnerability
- CVE-2024-29269, Telesquare TLR-2005KSH command injection vulnerability
- CVE-2025-10123, D-Link DIR-823X command injection vulnerability
- CVE-2025-55583: D-Link DIR-868L B1 router command injection vulnerability
All payload callbacks for these exploitation attempts pointed to the same loader URL at 91.92.40[.]118/wget.sh, linked to Evooo1Bot.
Lin assessed that the botnet has been actively targeting internet-facing devices since July 2026, exploiting multiple vulnerabilities across diverse regions.
Evooo1Bot, A Sophisticated Mirai-Class Botnet
Evooo1Bot reuses the distributed denial-of-service (DDoS) engine from the Mirai source code.
Mirai is a notorious malware strain that infects internet-of-things (IoT) devices using default credentials, turning them into a massive networks – a botnet – to launch DDoS attacks.
Its source code was publicly leaked in September 2016 on Hack Forums by user ‘Anna-senpai,’ later unmasked by the FBI as college student Paras Jha along with co-creators Josiah White and Dalton Norman.
Originally built to target Minecraft servers and sell DDoS-protection services, the creators released the code to flood the web with noise and obscure their identities as law enforcement closed in, inadvertently spawning countless modern malware variants that continue to reuse Mirai’s DDoS engine today.
Despite working from the Mirai framework, the developers of Evooo1Bot have significantly extended their malware with numerous capabilities, including:
- Encrypted command-and-control (C2) communications and a 28-command remote administration interface
- An SSH brute-force scanner
- A reverse SOCKS relay module
- Multiple layers of string obfuscation using AES-256-CTR, ChaCha20 and XOR-based key derivation
- A credential sniffer
- An integrated exploit arsenal targeting multiple known vulnerabilities across IoT devices, networking equipment and enterprise applications
Lin highlighted that the SOCKS relay module is “arguably the most operationally significant” as it transforms a compromised edge device into a persistent proxy, allowing the attacker to conceal their true origin, pivot into internal networks and conduct follow-on operations through the victim’s infrastructure.
“These capabilities place Evooo1Bot well beyond the technical baseline of conventional Mirai-derived malware,” Lin wrote.
Read now: New Mirai Botnet Exploits Zero-Days in Routers and Smart Devices
