Evooo1Bot Linux Botnet Hijacks Routers for Traffic Relay

TL;DR. A new Mirai-based Linux botnet, Evooo1Bot, is actively compromising internet-facing routers globally, exploiting vulnerabilities to turn them into malicious SOCKS5 traffic relay nodes for various cybercriminal activities, significantly expanding its illicit network capabilities. - Evooo1Bot is a Mirai-based Linux botnet. - It compromises internet-facing routers. - Infected routers become SOCKS5 traffic relay nodes.

• Evooo1Bot expands on Mirai's DDoS capabilities with encrypted C2, SSH brute-forcing, and credential sniffing.
• The botnet exploits known vulnerabilities in devices from Alcatel, NETGEAR, Tenda, and Mitsubishi Electric.
• Compromised devices can conceal malicious traffic, bypass geoblocks, and potentially monetize through proxy services.
• Fortinet researchers discovered Evooo1Bot, noting its modular design and extensive anti-detection checks.

Back to QLANKR News