A newly identified Linux botnet family has been actively exploiting 10 known vulnerabilities in edge devices since July 2026, according to analysis published August 13 by Fortinet's FortiGuard Labs. Researcher Yi Ping (Cara) Lin named the threat Evooo1Bot after a hardcoded string found in every binary sample. Built on the publicly leaked Mirai source code, the botnet significantly exceeds the technical baseline of typical Mirai variants by integrating advanced capabilities that transform compromised devices into persistent proxy infrastructure for follow-on attacks.
The botnet's exploitation campaign targets vulnerabilities spanning nearly two decades of hardware, from a 2007 remote code execution flaw in Alcatel OmniPCX Enterprise systems to three command injection weaknesses disclosed in 2025 affecting D-Link routers. The targeted flaws include CVE-2016-6277 in NETGEAR routers, three separate command injection bugs in Tenda routers (CVE-2018-14558, CVE-2020-10987), a 2019 vulnerability in Mitsubishi and INEA industrial RTU devices, two Telesquare device flaws (CVE-2021-46422, CVE-2024-29269), and a 2022 buffer overflow in D-Link equipment. All payload callbacks observed during exploitation attempts pointed to the same loader URL at 91.92.40[.]118/wget.sh, confirming a unified infrastructure behind the campaign across diverse geographic regions.
Lin highlighted that the botnet's SOCKS relay module represents "arguably the most operationally significant" feature, as it converts a compromised edge device into a persistent proxy that lets attackers hide their true location, pivot into internal networks, and carry out subsequent operations through the victim's own infrastructure. The malware reuses Mirai's distributed denial-of-service engine but extends it with a 28-command remote administration interface, encrypted command-and-control communications, an SSH brute-force scanner, multiple layers of string obfuscation using AES-256-CTR, ChaCha20, and XOR-based key derivation, a credential sniffer, and an integrated exploit arsenal. According to Lin's assessment, these capabilities place Evooo1Bot well beyond conventional Mirai-derived malware families.
The botnet's foundation traces back to September 2016, when Hack Forums user 'Anna-senpai' publicly released Mirai's source code—later revealed by the FBI to be college student Paras Jha and co-creators Josiah White and Dalton Norman, who originally built the malware to target Minecraft servers and sell DDoS-protection services. The creators released the code to flood the web with noise and obscure their identities as law enforcement closed in, inadvertently spawning countless modern malware variants that continue to reuse Mirai's DDoS engine today. The Evooo1Bot developers have leveraged this publicly available foundation to construct a modular threat that combines volume-based DDoS capabilities with advanced persistence, obfuscation, and lateral movement features typically associated with more sophisticated intrusion toolkits. The encryption of command-and-control traffic and multi-layered obfuscation techniques complicate detection efforts, while the integrated exploit arsenal enables rapid propagation across vulnerable internet-facing devices without requiring manual operator intervention. The botnet's ability to brute-force SSH credentials and sniff authentication data from compromised systems further extends its reach beyond the initial foothold established through vulnerability exploitation, creating multiple pathways for persistence and expansion across enterprise and consumer networks. Organizations running the affected devices face not only the immediate risk of DDoS participation but also the prospect of serving as unwitting proxies for attacks against third parties or gateways into segmented internal networks.