FortiGuard Labs has documented a previously unreported Linux botnet family, Evooo1Bot, that blends old Mirai-style DDoS behavior with newer capabilities that matter to defenders: encrypted command-and-control, SSH brute forcing, SOCKS proxy relay, credential sniffing, persistence, and exploit-driven infection of exposed devices.

The immediate lesson is simple: this is not just another “router botnet.” Evooo1Bot is built to turn vulnerable internet-facing systems into infrastructure an attacker can reuse for access, anonymity, scanning, proxying, and follow-on operations.

What FortiGuard reported

FortiGuard says its telemetry observed exploitation attempts tied to a shared loader URL, with payloads selected by CPU architecture. The campaign targets a mix of older and newer vulnerabilities across routers, telecom gear, and industrial-adjacent devices, including flaws affecting NETGEAR, Tenda, D-Link, Telesquare, Alcatel OmniPCX, and Mitsubishi Electric/INEA ME-RTU devices.

Once running, the malware checks for analysis tools, sandboxes, virtualized environments, and common honeypot indicators before connecting to command-and-control infrastructure over TCP 443. That choice is deliberate: outbound traffic on 443 is often treated as normal background noise unless organizations are inspecting destinations and behavior.

Why SMBs and government contractors should care

Small businesses and subcontractors often have the exact exposure profile this kind of malware likes: aging edge devices, vendor-managed appliances, remote access gear, small Linux servers, and limited continuous monitoring. Government contractors also need to think beyond direct data theft. A compromised office router, field device, or forgotten Linux box can become a proxy node used to attack someone else, creating legal, operational, and reputational risk.

The SOCKS relay capability is especially important. It means an infected device can become a staging point for attacker traffic. That can make malicious activity appear to originate from a legitimate residential, business, or contractor network. For organizations supporting government customers, this raises the stakes around egress monitoring, asset inventory, and third-party device management.

Defensive takeaways

  • Find exposed edge devices first. Inventory internet-facing routers, firewalls, VPN appliances, PBX systems, industrial gateways, and Linux-based management boxes. If it has a web admin panel or SSH on the internet, treat it as a priority.
  • Patch by exposure, not just CVSS. Evooo1Bot chains a broad exploit arsenal, including older bugs that remain dangerous because appliances stay online for years.
  • Kill default and weak SSH credentials. Disable password login where possible, enforce keys/MFA, and monitor failed login spikes from internal and external sources.
  • Watch outbound 443 behavior. Alert on unusual destinations, long-lived encrypted sessions from devices that should not be making them, and unexpected traffic from appliances to VPS/cloud hosting providers.
  • Block unauthorized proxy behavior. Look for SOCKS listeners, unexpected port 1080 exposure, and devices initiating relay-like outbound sessions.
  • Validate persistence locations. On Linux devices and servers, review systemd units, cron entries, init scripts, rc.local, and profile.d entries for suspicious download-and-execute patterns.

Bulwark Black assessment

Evooo1Bot is a good example of where commodity botnets are headed: not necessarily novel at every layer, but operationally useful. The combination of DDoS, brute force, credential capture, exploit dispatching, and proxy relay gives an operator multiple ways to monetize or reuse access.

For defenders, the practical move is to stop treating small edge devices as “set and forget” infrastructure. They need ownership, patch windows, configuration baselines, and log review just like servers and endpoints. If a device cannot be patched, monitored, or strongly authenticated, it should not be directly reachable from the internet.

Original research: FortiGuard Labs — Multi-Functional Linux Botnet “Evooo1Bot”