A previously unknown Linux botnet called Evooo1Bot has been identified by cybersecurity researchers, representing the latest evolution of threats derived from the leaked Mirai botnet source code. The malware specifically targets internet-facing devices and converts compromised systems into SOCKS proxies while retaining the distributed denial-of-service attack capabilities that made Mirai notorious.
The Mirai botnet source code was publicly leaked in 2016 and has since spawned numerous variants that continue to threaten connected devices worldwide. Evooo1Bot follows this pattern by reusing Mirai's proven attack framework while adding new functionality that expands its operational capabilities beyond simple DDoS attacks.
The malware extends the original Mirai framework with multiple new capabilities, most notably the ability to transform infected devices into SOCKS proxy servers. This functionality allows attackers to route malicious traffic through compromised devices, effectively masking the true origin of attacks and enabling additional criminal activities. The combination of DDoS capabilities and proxy functionality makes Evooo1Bot a versatile tool for cybercriminals.
Internet-facing devices remain attractive targets for botnet operators because many run outdated firmware with known security vulnerabilities. Once compromised, these devices can be conscripted into botnets without the owner's knowledge, contributing to attacks against other targets while potentially degrading the device's performance and security posture.
Organizations should conduct thorough audits of all internet-exposed devices and systems, ensuring that security patches are applied promptly and default credentials are changed. Network administrators should monitor for unusual outbound proxy traffic and implement network segmentation to limit the potential impact of compromised devices. Regular firmware updates and strong authentication practices remain essential defenses against botnet infections.
Source: https://thehackernews.com/2026/08/evooo1bot-linux-botnet-exploits-known.html