Linux Botnet ‘Evooo1Bot’ Turns Everyday Devices Into a Stealth Cyber Attack Network
A newly documented Linux botnet dubbed Evooo1Bot is infecting routers, firewalls, cameras and other internet-facing devices, turning them into SOCKS5 proxies, DDoS nodes and credential thieves. Building on Mirai-style code but adding credential sniffing and SSH brute forcing, the malware quietly repurposes household and enterprise hardware into a global attack platform. The article explains how it works and what’s at stake for networks that barely know these devices are on their front line.
A new strain of malware is quietly turning the weakest, most forgotten devices on the internet into a potent tool for cyber attackers. Security researchers have identified a Linux botnet dubbed Evooo1Bot that targets routers, firewalls, IP cameras and other exposed edge devices, exploiting known vulnerabilities to conscript them into a distributed network of SOCKS5 proxies. Once infected, these everyday devices can be directed to relay traffic, launch distributed denial-of-service (DDoS) attacks, sniff credentials and brute-force SSH logins, all while their owners may have little idea anything is wrong. Evooo1Bot builds on the long-running Mirai family of malware that has plagued the internet of things for nearly a decade. But…
Pro features include
- 60+ analytical tools across markets and intelligence
- Custom alerts, watchlists, and AOI monitoring
- Daily Pro brief at 6 PM ET — 12 hours before free tier
- Conflict deep dives and premium research products