Evooo1Bot: New Mirai-Based Linux Botnet Exploiting Edge Devices

• •Evooo1Bot exploits multiple vulnerabilities in Linux edge devices since July 2026.
• •The botnet uses a loader script to download and execute malware, turning devices into proxies.
• •It features advanced capabilities, including encrypted communications and credential sniffing.

FortiGuard Labs has identified a new Linux botnet named Evooo1Bot, which is based on the Mirai malware framework. This botnet targets internet-facing edge devices, exploiting multiple vulnerabilities since July 2026. The botnet utilizes a loader script at 91.92.40[.]118/wget.sh to download and execute its payloads. Evooo1Bot incorporates advanced features such as encrypted C2 communications, an SSH brute-force scanner, and a SOCKS relay module that allows attackers to use compromised devices as proxies. The botnet's capabilities extend beyond conventional Mirai variants, posing a significant threat to organizations. Security researchers have observed targeted exploitation attempts across various regions, affecting any organization with vulnerable Linux systems. The botnet's modular architecture enables it to adapt and execute various commands based on the operator's needs.