CyberNew CyberNew
Ransomware & Malware Dark Reading 1 month ago

Linux Botnet Evooo1Bot Expands Mirai Capabilities Well Beyond DDoS

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: HIGH
Impacted Surface
Cloud & Distributed Infrastructure
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"Yet another Mirai-derived botnet is on the loose, targeting Linux systems by exploiting flaws in various Internet-facing devices to combine distributed denial of service (DDoS) attacks with a broader set of malicious capabilities. The botnet, tracked as "Evooo1Bot" by the research team at Fortiguard Labs, has been actively targeting Internet-facing devices — including equipment from Alcatel,..."

Recommended Defense & Mitigation

  • Access Review: Audit administrative roles, enforce phishing-resistant MFA, and review privilege escalations.
  • Credential Rotation: Rotate high-privilege service credentials and tokens associated with impacted services.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Yet another Mirai-derived botnet is on the loose, targeting Linux systems by exploiting flaws in various Internet-facing devices to combine distributed denial of service (DDoS) attacks with a broader set of malicious capabilities.

The botnet, tracked as "Evooo1Bot" by the research team at Fortiguard Labs, has been actively targeting Internet-facing devices — including equipment from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link — since at least July, according to a report published Friday.

"Evooo1Bot is a Linux botnet family that incorporates the Mirai DDoS engine into a significantly more capable and modular framework," Fortiguard Labs threat researcher Cara Lin explained in the report.

The researchers named the botnet — which exploits a host of vulnerabilities as old as 2007 as well as flaws discovered just last year — after finding the hardcoded string "evooo1" in every binary. Evooo1Bot reuses the DDoS engine from the publicly leaked Mirai source code, but goes much further than that, giving attackers a multifunctional platform for compromising and monetizing vulnerable Linux-based devices, she said.

Related:CISOs Break Their Silence in 'Declassified' Docuseries

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →