{"id":2364,"date":"2026-08-17T10:47:50","date_gmt":"2026-08-17T10:47:50","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2364"},"modified":"2026-08-17T10:47:50","modified_gmt":"2026-08-17T10:47:50","slug":"evooo1bot-linux-botnet-exploits-known-flaws-to-turn-edge-devices-into-socks5-proxies","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2364","title":{"rendered":"Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 17, 2026<\/span><\/span>Malware \/ Botnet<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot<\/strong> that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies.<\/p>\n

\u00abWhile the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities,\u00bb Fortinet FortiGuard Labs said<\/a>.<\/p>\n

Evidence indicates that the botnet has been active in the wild since July 2026, exploiting known vulnerabilities in publicly-accessible devices to deliver the malware. Some of the security flaws weaponized by the botnet are below –<\/p>\n