Evooo1Bot Linux Botnet Uses 16 DDoS Methods and SOCKS5 Proxies to Hijack Edge Devices

A newly tracked Linux botnet is turning exposed edge devices into tools for disruption, remote access, and traffic relaying.

Evooo1Bot is the threat that reaches internet-facing edge systems by exploiting known flaws and attempting weak SSH logins.

Its operators can then issue commands through an encrypted control channel. The campaign is more than another basic denial-of-service operation.

It combines code drawn from the leaked Mirai framework with proxy, credential-sniffing, file-transfer, and exploit functions.

That mix gives intruders several ways to use a single compromised device and mirrors recent Mirai botnet trends toward broader abuse.

Fortinet analysts identified the malware after seeing active exploitation attempts against a range of edge devices.