Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Summary: Fortinet FortiGuard Labs flagged a previously undocumented Linux botnet called Evooo1Bot that reuses the Mirai DDoS engine and adds encrypted C2 on port 443, an SSH brute-force scanner, a credential sniffer, and a SOCKS5 relay module. Active in the wild since July 2026, it exploits eight known flaws - including Hikvision CVE-2021-36260, Atlassian Confluence CVE-2022-26134, WSO2 CVE-2022-29464, Zyxel CVE-2022-30525, TP-Link CVE-2023-1389, PHP CVE-2024-4577, D-Link CVE-2024-10914, and Kubernetes CVE-2025-1974 - to deliver a loader script that clears Bash history before pulling an architecture-matched binary.
Key Takeaway: Every infected router, firewall, or IP camera becomes a SOCKS5 proxy that lets the actor relay traffic through your IP address, bypass geographic restrictions, and reach internal networks from an already compromised machine - and the port 443 C2 means perimeter traffic looks like ordinary HTTPS.