Multi-Functional Linux Botnet “Evooo1Bot”

FortiGuard Labs details Evooo1Bot, a Mirai-derived Linux botnet active since July 2026 that extends Mirai with encrypted C2, SSH brute-forcing, a SOCKS5 reverse relay, credential sniffing, a modular CVE exploit dispatcher, persistence mechanisms, and a 28-command remote administration interface; telemetry and IOCs (91.92.40.118 and file hashes) show active exploitation of numerous IoT and network device vulnerabilities, and Fortinet detections and mitigations are provided.