Evooo1Bot Botnet Hijacks Linux Gateways for DDoS, SOCKS5 Relaying, and SSH Attacks

FortiGuard Labs disclosed on August 13, 2026, a high-severity Mirai-variant botnet called Evooo1Bot that compromises Linux-based routers, firewalls, and cameras by exploiting over a dozen known CVEs and brute-forcing more than 150 credential combinations. Once installed, the malware deploys architecture-specific payloads across 12 CPU types and establishes encrypted command-and-control communications over TCP port 443. The botnet supports a broad range of malicious capabilities, including 16 DDoS flood methods, SOCKS5 proxying, SSH credential spreading, HTTP credential sniffing, and multiple persistence mechanisms such as systemd, cron, and rc.local. Targeted devices include products from NETGEAR, D-Link, Tenda, Hikvision, Zyxel, TP-Link, Alcatel, and Mitsubishi Electric, among others. The threat actor behind Evooo1Bot remains unidentified in public reporting.