New Mirai variant adds stealth capabilities to notorious botnet code

FortiGuard Labs researchers report a newly observed Mirai-derived Linux botnet named Evooo1Bot that has actively exploited unpatched vulnerabilities in various consumer and enterprise devices (Alcatel, D-Link, Netgear, Tenda, Mitsubishi Electric, Telesquare). Evooo1Bot extends Mirai functionality with encrypted C2, SSH scanning that avoids honeypots, credential-sniffing, and SOCKS proxying—allowing compromised edge devices to be used as persistent proxies for concealment and lateral action; activity has been observed across multiple continents.