New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies

Researchers at Fortinet’s FortiGuard Labs describe ‘Evooo1Bot’, a Mirai-derived modular Linux botnet observed exploiting numerous known vulnerabilities in routers and edge devices and deploying a common loader (91.92.40.118/wget.sh); the malware reuses Mirai’s DDoS engine but adds encrypted C2, an SSH brute-force scanner, a reverse SOCKS relay (enabling proxying/pivoting), credential stealing and an integrated exploit arsenal, with active exploitation observed since July 2026.