Evooo1Bot Linux Botnet Targets Internet-Facing Devices to Build SOCKS5 Relay Network

Severity
Medium

Detail

A new Mirai-based Linux botnet called Evooo1Bot has been targeting internet-facing gateway devices and turning compromised systems into SOCKS5 traffic relay nodes. The malware also includes credential theft, SSH brute-force scanning, DDoS capabilities, and an integrated vulnerability exploitation module.

Fortinet researchers identified Evooo1Bot targeting devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link across various regions by exploiting known vulnerabilities. The malware reuses the DDoS engine from the publicly leaked Mirai source code but extends it with several additional capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an exploit arsenal targeting multiple vulnerabilities.

Newer Evooo1Bot builds include a separate exploitation module targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installations. Fortinet noted that some embedded exploits are incorrectly implemented and therefore fail to compromise vulnerable systems.

How?

Evooo1Bot gains access by exploiting known vulnerabilities in internet-facing devices. When exploitation succeeds, a script downloads one of 12 malware builds matching the target device’s CPU architecture and subsequently clears Bash history to remove traces of the attack.

The malware communicates with its command-and-control infrastructure using encrypted communications over port 443. Before launching, it performs extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots.

Once installed, Evooo1Bot establishes persistence through systemd, SysV init, shell profiles, and rc.local. It also creates a cron job that attempts to download the payload again every five minutes.

The malware provides operators with an interactive shell for direct control of compromised devices and supports file uploads and downloads. Its credential-sniffing component monitors /proc/net/tcp and attempts to capture HTTP Basic Authentication and Cookie headers.

Evooo1Bot also contains a SOCKS5 relay module that supports both direct listening and reverse-relay modes. This allows attackers to conceal malicious traffic, bypass geographic restrictions, and potentially access networks through compromised systems. Multiple proxy sessions can operate independently and simultaneously.

The malware’s SSH scanner uses 150 username and password combinations focused on enterprise-oriented accounts. After successful authentication, it performs additional checks designed to avoid honeypots.

The DDoS functionality inherited from Mirai supports 16 flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and HTTP flooding with customizable requests.

Impact

Compromised devices can be incorporated into the Evooo1Bot botnet and used as SOCKS5 traffic relay nodes, allowing attackers to route and conceal malicious traffic through compromised systems.
The malware can also provide attackers with interactive shell access, steal credentials, transfer files, conduct SSH brute-force attacks, and launch DDoS attacks. Fortinet noted that if the botnet becomes sufficiently large, the SOCKS5 relay capability could potentially be used for monetization through residential proxy services.

Recommendation

Organizations should:

• Keep IoT device firmware updated.
• Replace default administrator credentials.
• Disable remote access panels where they are not required.
• Replace devices when the vendor no longer provides security support.
• Monitor internet-facing devices for unusual outbound communications and unexpected activity.

Conclusion

Evooo1Bot expands on the Mirai botnet framework by combining vulnerability exploitation, credential theft, SSH brute forcing, SOCKS5 proxying, persistence, encrypted C2 communications, and DDoS capabilities. The malware’s ability to turn compromised gateway devices into traffic relay nodes increases the potential value of infected systems to its operators. Securing internet-facing IoT and gateway devices through timely firmware updates, strong credentials, restricted remote access, and replacement of unsupported equipment remains important for reducing exposure.

Source

https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes/
https://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot