FortiGuard Labs has disclosed a new Mirai-derived Linux botnet, dubbed Evooo1Bot, that has been actively compromising internet-facing routers, firewalls, cameras, and industrial edge devices since at least July 2026. Unlike a typical Mirai variant that leans on a handful of default-credential and telnet-based infection paths, Evooo1Bot ships an integrated exploit arsenal targeting eight distinct, previously disclosed CVEs — some nearly two decades old — and repurposes compromised hosts as a monetizable SOCKS5 proxy network rather than pure DDoS cannon fodder.

What happened

FortiGuard’s IPS telemetry picked up a wave of exploitation attempts carrying a distinct payload-delivery pattern across geographically diverse internet-facing devices. Analysis of the retrieved binaries showed the DDoS attack engine was lifted directly from the leaked Mirai source code, but built out with capabilities the original Mirai never had: encrypted command-and-control communications, a dedicated SSH brute-force scanner, a credential sniffer, and a SOCKS5 relay module supporting both direct-listen and reverse-relay modes. Operators embed per-campaign labels in the malware’s download commands, suggesting they are tracking infection yield on a per-vulnerability basis — treating each exploited CVE as a separate, measurable acquisition channel rather than running one undifferentiated spray-and-pray campaign.

Technical details

The confirmed exploit chain spans eight CVEs across six vendors: CVE-2007-3010 (Alcatel OmniPCX Enterprise RCE), CVE-2016-6277 (NETGEAR multiple routers RCE), CVE-2018-14558 and CVE-2020-10987 (Tenda AC-series command injection and RCE), CVE-2019-14931 (Mitsubishi Electric ME-RTU command injection — notable as one of the only industrial-control targets in the set), CVE-2021-46422 (Telesquare SDT-CW3B1 command injection), and CVE-2022-37055 and CVE-2025-55583 (D-Link router buffer overflow and command injection). All eight are pre-authentication, network-reachable vulnerabilities with public proof-of-concept exploit code, which is precisely the profile Mirai-family botnets have always favored: no credential guessing required, just direct RCE against unpatched, internet-exposed management interfaces.

Once a device is compromised, Evooo1Bot’s SOCKS5 module lets the operator either accept inbound proxy connections directly on the infected host or relay traffic back through encrypted C2 infrastructure — architecture built for reselling proxy access through residential/commercial proxy marketplaces at scale, independent of whatever DDoS-for-hire revenue the botnet also generates.

Impact

Because the exploited flaws span consumer routers (NETGEAR, Tenda, D-Link), enterprise telephony (Alcatel), and an industrial RTU (Mitsubishi Electric), the exposure isn’t confined to home networks. Any organization running an unpatched, internet-facing instance of these product lines — including devices well past end-of-support that will never receive a fix — is a viable target. The credential-sniffing and SSH brute-force modules also mean a compromised edge device can become a foothold for lateral movement into the network behind it, not just an outbound DDoS/proxy node.

Mitigation

  • Inventory internet-facing routers, firewalls, cameras, and RTUs/ICS gateways and cross-reference firmware versions against the eight CVEs above; patch or replace anything still exposed, with particular urgency for CVE-2025-55583 and CVE-2022-37055 given active exploitation.
  • Take management interfaces (HTTP/HTTPS admin panels, telnet, SSH) off the public internet; restrict access to VPN or management-VLAN only.
  • For end-of-life devices (notably older Tenda and D-Link models with no forthcoming patch), isolate or retire them — there is no fix path available.
  • Monitor for unexpected outbound SOCKS5/proxy traffic and SSH brute-force attempts originating from edge devices, and watch for unusual encrypted C2 beaconing from device management IP ranges.
  • Disable unused services (telnet, UPnP, remote management) on all internet-facing network appliances as standard hardening regardless of current patch status.

Sources