CVE

CVE-2024-4577

View on NVD ↗

Argument Injection in PHP-CGI

Exploitation IoCs 2

Filename wget.sh
IP 91[.]92[.]40[.]118

MITRE ATT&CK TTPs 13

T1003
OS Credential Dumping
Credential Access
 T1018
Remote System Discovery
Discovery
 T1021.004
SSH
Lateral Movement
 T1027
Obfuscated Files or Information
Defense Evasion
 T1048
Exfiltration Over Alternative Protocol
Exfiltration
 T1057
Process Discovery
Discovery
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1078
Valid Accounts
Defense Evasion
 T1083
File and Directory Discovery
Discovery
 T1133
External Remote Services
Persistence
 T1210
Exploitation of Remote Services
Lateral Movement
 T1496
Resource Hijacking
Impact

Source Articles

Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Evooo1Bot is a newly identified Linux botnet derived from Mirai source code that targets internet-facing edge devices by exploiting known vulnerabilities. It installs a SOCKS5 proxy on compromised systems, enabling threat actors to route traffic through infected devices for evasion and anonymity. The malware includes an exploit toolkit targeting multiple CVEs, performs anti-analysis checks, and communicates with C2 servers over encrypted channels on port 443. It supports various post-compromise actions including DDoS attacks, credential sniffing, SSH brute-forcing, and lateral movement.
hacker-news Aug 17, 2026