Back Infosecurity-Magazine

New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies

Infosecurity-Magazine • August 14, 2026

A new modular Linux botnet family based on publicly leaked source code from the Mirai botnet has been linked to exploitation attempts for several vulnerabilities in edge devices.

A Taiwan-based security researcher at Fortinet’s FortiGuard Labs, Yi Ping (Cara) Lin, shared an analysis of the new botnet family on August 13, which she called ‘Evooo1Bot’ after the hardcoded string ‘evooo1’ found in every binary.

The botnet was discovered after observed exploitation of the following vulnerabilities:

All payload callbacks for these exploitation attempts pointed to the same loader URL at 91.92.40[.]118/wget.sh, linked to Evooo1Bot.

Lin assessed that the botnet has been actively targeting internet-facing devices since July 2026, exploiting multiple vulnerabilities across diverse regions.

Evooo1Bot reuses the distributed denial-of-service (DDoS) engine from the Mirai source code.

Mirai is a notorious malware strain that infects internet-of-things (IoT) devices using default credentials, turning them into a massive networks – a botnet – to launch DDoS attacks.

Its source code was publicly leaked in September 2016 on Hack Forums by user ‘Anna-senpai,’ later unmasked by the FBI as college student Paras Jha along with co-creators Josiah White and Dalton Norman.

Originally built to target Minecraft servers and sell DDoS-protection services, the creators released the code to flood the web with noise and obscure their identities as law enforcement closed in, inadvertently spawning countless modern malware variants that continue to reuse Mirai's DDoS engine today.

Despite working from the Mirai framework , the developers of Evooo1Bot have significantly extended their malware with numerous capabilities, including:

Lin highlighted that the SOCKS relay module is “arguably the most operationally significant” as it transforms a compromised edge device into a persistent proxy, allowing the attacker to conceal their true origin, pivot into internal networks and conduct follow-on operations through the victim's infrastructure.

“These capabilities place Evooo1Bot well beyond the technical baseline of conventional Mirai-derived malware,” Lin wrote.

Read now: New Mirai Botnet Exploits Zero-Days in Routers and Smart Devices

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Evooo1Bot: New Mirai-Based Linux Botnet Exploiting Edge Devices FortiGuard Labs has identified a new Linux botnet named Evooo1Bot, which is based on the Mirai malware framework. This botnet targets internet-facing edge devices, exploiting multiple vulnerabilities since July 2026. The botnet utilizes a loader script at 91.92.40[.]118/wget.sh to download and execute its payloads. Evooo1Bot incorporates advanced features such as encrypted C2 communications, an SSH brute-force scanner, and a SOCKS relay module that allows attackers to use compromised devices as proxies. The botnet's capabilities extend beyond conventional Mirai variants, posing a significant threat to organizations. Security researchers have observed targeted exploitation attempts across various regions, affecting any organization with vulnerable Linux systems. The botnet's modular architecture enables it to adapt and execute various commands based on the operator's needs. 17 sources 67

Extracted Entities

New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies

The full story

Extracted Entities

Attack Types (3)

CWE Weaknesses (1)

IP Addresses (1)

Malware (2)

MITRE ATT&CK (3)

Platforms (1)

Tools (1)