Linux Botnet Evooo1Bot Expands Mirai Capabilities Well Beyond DDoS

FortiGuard Labs identified a Mirai-derived Linux botnet named Evooo1Bot actively exploiting numerous known vulnerabilities in routers, cameras, and other edge devices to deploy a modular platform that combines DDoS capabilities with encrypted C2, SSH brute-force, credential theft, persistence mechanisms, and a reverse SOCKS proxy that can be used to pivot and conceal attacker activity; observed indicators include callbacks to 91.92.40.118/wget.sh and exploitation of multiple CVEs dating back to 2007. Defenders are advised to patch or replace exposed appliances, inspect for unauthorized cron/systemd/init changes, investigate unexpected SSH activity, and monitor for devices acting as SOCKS/proxy endpoints.