Evooo1Bot Linux Botnet

Technical Analysis

Evooo1Bot derives from the Mirai codebase and retains its modular architecture, allowing operators to deploy additional functional components post-infection, including the SOCKS5 proxy module observed in current campaigns. The malware targets internet-facing gateway and router devices, likely exploiting weak or default credentials and known unpatched vulnerabilities common in consumer and SOHO networking equipment, consistent with typical Mirai-family infection vectors. Compromised devices are repurposed as relay nodes, enabling threat actors to route traffic through victim infrastructure, which complicates attribution and can facilitate downstream attacks including credential stuffing, C2 masking, and DDoS staging. Organizations running AI agent infrastructure behind compromised gateway/router devices could have agent-to-API or agent-to-tool traffic silently relayed or intercepted through the SOCKS5 proxy, exposing API keys and inference traffic to third parties, and compromised routers could also serve as a pivot point into internal networks hosting agent orchestration systems.

Affected Systems

Internet-facing gateway devices and consumer/SOHO routers running embedded Linux; devices with weak, default, or exposed administrative credentials and outdated firmware

Indicators of Compromise

• No specific hashes, IPs, or domains disclosed in source reporting at time of publication

Remediation Steps

1. 1

   Change default credentials

   Replace all default or weak administrative passwords on routers and gateway devices with strong, unique credentials.

2. 2

   Update firmware

   Apply the latest vendor firmware updates to close known vulnerabilities exploited by Mirai-family malware.

3. 3

   Disable unnecessary remote administration

   Turn off remote/WAN-facing management interfaces (Telnet, SSH, HTTP admin panels) unless strictly required, and restrict access via firewall rules.

4. 4

   Monitor for anomalous outbound traffic

   Inspect network traffic for unexpected SOCKS5 proxy connections or unusual outbound relay activity originating from routers/gateways.

5. 5

   Segment IoT/network devices

   Place routers and gateway devices on isolated network segments away from critical infrastructure, including any systems running AI agent or LLM tooling, to limit lateral movement and traffic interception risk.