Ethical Hacking News

Evooo1Bot Linux Botnet Exploits Known Vulnerabilities to Turn Edge Devices into SOCKS5 Proxies

The Evooo1Bot Linux botnet has been found to exploit a range of known vulnerabilities in publicly-accessible devices, turning edge devices into SOCKS5 proxies to carry out malicious activities. This threat highlights the importance of ensuring that devices are up-to-date with the latest security patches and implementing robust security protocols to prevent exploitation.

The Evooo1Bot Linux botnet is a threat that utilizes known vulnerabilities in publicly-accessible devices to deliver malware.

The malware can turn internet-facing devices into SOCKS5 proxies, allowing attackers to conduct follow-on operations and evade detection.

The botnet exploits a range of known vulnerabilities, including several CVEs.

The malware executes a loader shell script, retrieves the botnet binary, and clears the Bash history to erase any traces of the attack.

The C2 server plays a crucial role in the operation of the botnet, receiving instructions and commands, and serving as a hub for communication with other devices.

The botnet's ability to turn edge devices into SOCKS5 proxies increases the value of an infected host to attackers.

The Evooo1Bot botnet has limitations, including reliance on the Mirai botnet source code and vulnerability to detection by security professionals.

Individuals and organizations must take steps to protect themselves from this threat, including ensuring device updates and implementing robust security protocols.

The cybersecurity landscape is ever-evolving, with new and sophisticated threats emerging on a daily basis. One such threat that has garnered significant attention in recent times is the Evooo1Bot Linux botnet. This botnet, which has been dubbed as a threat by Fortinet FortiGuard Labs, has been utilizing known vulnerabilities in publicly-accessible devices to deliver malware. The malware, which is derived from the Mirai botnet source code, has the capability to turn internet-facing devices into SOCKS5 proxies, thereby allowing attackers to conduct follow-on operations and evade detection.

The Evooo1Bot botnet has been found to exploit a range of known vulnerabilities, including CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, CVE-2025-10123, and CVE-2025-55583. These vulnerabilities are present in a variety of devices, including routers, firewalls, IP cameras, and other edge devices. The malware is able to take advantage of these vulnerabilities by exploiting the weaknesses in the devices' security protocols.

Once a device has been compromised, the malware will execute a loader shell script, which will then retrieve the botnet binary that is compatible with the device's CPU architecture. The script will also clear the Bash history to erase any traces of the attack. Upon execution, the binary will check for the presence of analysis tools, sandboxes, and virtual environments before establishing encrypted communications with a command-and-control (C2) server on port 443.

The C2 server plays a crucial role in the operation of the Evooo1Bot botnet. It is from this server that the malware receives instructions and commands, which are used to carry out various malicious activities. The C2 server also serves as a hub for the malware to communicate with other devices within the botnet, allowing the attackers to coordinate their efforts and conduct more sophisticated attacks.

One of the most significant capabilities of the Evooo1Bot botnet is its ability to turn edge devices into SOCKS5 proxies. This capability allows attackers to disguise malicious traffic, bypass geographic restrictions, or provide access to internal networks through an already compromised machine. The SOCKS5 proxy capability significantly increases the value of an infected host to attackers, making it an attractive target for further exploitation.

The Evooo1Bot botnet is not without its limitations, however. Fortinet FortiGuard Labs has noted that the malware relies on the Mirai botnet source code, which may limit its capabilities compared to other malware. Additionally, the botnet's reliance on known vulnerabilities may make it vulnerable to detection by security professionals.

Despite these limitations, the Evooo1Bot botnet remains a significant threat to cybersecurity professionals and individuals alike. Its ability to exploit known vulnerabilities and turn edge devices into SOCKS5 proxies makes it a powerful tool in the arsenal of attackers. As such, it is essential that individuals and organizations take steps to protect themselves from this threat, including ensuring that their devices are up-to-date with the latest security patches and implementing robust security protocols to prevent exploitation.

In conclusion, the Evooo1Bot Linux botnet is a significant threat to cybersecurity professionals and individuals alike. Its ability to exploit known vulnerabilities and turn edge devices into SOCKS5 proxies makes it a powerful tool in the arsenal of attackers. As such, it is essential that individuals and organizations take steps to protect themselves from this threat.

Related Information:

https://www.ethicalhackingnews.com/articles/Evooo1Bot-Linux-Botnet-Exploits-Known-Vulnerabilities-to-Turn-Edge-Devices-into-SOCKS5-Proxies-ehn.shtml

https://thehackernews.com/2026/08/evooo1bot-linux-botnet-exploits-known.html

https://nvd.nist.gov/vuln/detail/CVE-2007-3010

https://www.cvedetails.com/cve/CVE-2007-3010/

https://nvd.nist.gov/vuln/detail/CVE-2016-6277

https://www.cvedetails.com/cve/CVE-2016-6277/

https://nvd.nist.gov/vuln/detail/CVE-2018-14558

https://www.cvedetails.com/cve/CVE-2018-14558/

https://nvd.nist.gov/vuln/detail/CVE-2019-14931

https://www.cvedetails.com/cve/CVE-2019-14931/

https://nvd.nist.gov/vuln/detail/CVE-2020-10987

https://www.cvedetails.com/cve/CVE-2020-10987/