hacker-news · Crawled Aug 17, 2026
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
2 IoCs 3 CVEs
Read original article ↗
AI Summary
Evooo1Bot is a newly identified Linux botnet derived from Mirai source code that targets internet-facing edge devices by exploiting known vulnerabilities. It installs a SOCKS5 proxy on compromised systems, enabling threat actors to route traffic through infected devices for evasion and anonymity. The malware includes an exploit toolkit targeting multiple CVEs, performs anti-analysis checks, and communicates with C2 servers over encrypted channels on port 443. It supports various post-compromise actions including DDoS attacks, credential sniffing, SSH brute-forcing, and lateral movement.
AI-extracted · verify before operational use
Extracted Entities 3 found
Indicators of Compromise 2 extracted
MITRE ATT&CK TTPs 19 techniques
T1003 OS Credential Dumping · Credential Access T1018 Remote System Discovery · Discovery T1021.004 SSH · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1048 Exfiltration Over Alternative Protocol · Exfiltration T1057 Process Discovery · Discovery T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1083 File and Directory Discovery · Discovery T1133 External Remote Services · Persistence T1210 Exploitation of Remote Services · Lateral Movement T1496 Resource Hijacking · Impact T1055 Process Injection · Defense Evasion T1059.004 Unix Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1190 Exploit Public-Facing Application · Initial Access T1212 Exploitation for Credential Access · Credential Access T1484 Domain or Tenant Policy Modification · Defense Evasion