Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
- ID
- 14781
- Status
- summarized
- Published
- 17 Aug 2026, 5:29 PM
- Fetched
- 17 Aug 2026, 8:47 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/evooo1bot-linux-botnet-exploits-known.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 17 Aug 2026, 8:50 PM
- Tags
- Audience
- developers
What happened
Fortinet FortiGuard Labs disclosed Evooo1Bot, a Mirai-derived Linux botnet active since July 2026 that exploits known CVEs in routers and edge devices (including D-Link, NETGEAR, Tenda, Telesquare, and Alcatel) to install SOCKS5 proxy relays. The malware uses encrypted C2 on port 443 to blend with HTTPS traffic, includes SSH brute-force and credential sniffing modules, and clears Bash history after installation.
Why it matters
If you run internet-facing edge devices or legacy routers in your infrastructure, patch or retire them—this botnet targets CVEs dating back to 2007, meaning unpatched devices are trivially compromised. For most SaaS founders and developers not managing edge hardware, this is low-impact; no action needed unless you operate exposed router or IoT infrastructure.
Discussion angle
Why decades-old CVEs still work in the wild and whether your own infrastructure has any forgotten edge devices exposed to the internet.