Evooo1Bot Linux Botnet Evolves Mirai Beyond DDoS Into Credential Theft

Researchers have identified a Linux-focused botnet tracked as Evooo1Bot that draws on leaked Mirai source code yet dramatically broadens its operational scope. Unlike traditional Mirai variants that focus almost exclusively on volumetric DDoS attacks, Evooo1Bot transforms compromised Linux and IoT devices into multi-purpose attacker infrastructure with persistent footholds inside enterprise and home networks.

The botnet's newest modules include built-in exploitation frameworks targeting unpatched CVEs in routers, DVRs, and small-office Linux appliances. Once a device is compromised, operators harvest stored credentials and SSH keys from the filesystem, allowing lateral movement into adjacent hosts and cloud workloads. The malware also deploys reverse SOCKS relays, effectively turning each infected endpoint into an anonymizing proxy that traffic can be funneled through for follow-on intrusions, fraud campaigns, or further malware delivery.

Defenders should immediately audit exposed Linux services and rotate any credentials that may have lived on internet-facing appliances. Operators concerned about credential exposure should validate stored passwords against known leaks using a password checker, while network teams can identify rogue reverse proxies and open relay services with a port scanner to spot unexpected listeners on ports commonly abused by SOCKS daemons. Devices reachable through anomalous egress paths should also be probed with a VPN and proxy detector to confirm whether a host is unknowingly tunneling attacker traffic.

Because Evooo1Bot capitalizes on weak default credentials and outdated firmware, the mitigations are well established but rarely enforced: disable remote management on devices that do not need it, apply vendor patches within published SLA windows, enforce key-based SSH authentication, and egress-filter outbound traffic to non-approved destinations. With each iteration, the Mirai family moves further away from opportunistic DDoS and closer to the playbook of state-aligned APT groups, making early detection and credential hygiene essential for every organization.