Evooo1Bot Linux Botnet Compromises Internet‑Facing Routers, Turns Them into SOCKS5 Relays and Credential Stealers
What Happened — A new Mirai‑derived botnet, Evooo1Bot, has been observed targeting a range of internet‑exposed gateway devices (Alcatel, NETGEAR, Tenda, Mitsubishi Electric, D‑Link, etc.). The malware installs a SOCKS5 proxy, steals credentials, brute‑forces SSH, and can launch DDoS attacks. It spreads by exploiting known vulnerabilities in routers, firewalls, cameras, and even web‑applications such as Atlassian Confluence.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how un‑patched network assets can become a control gap that undermines the Security principle of SOC 2.
- Continuous evidence of vulnerability remediation and configuration compliance is essential to prove due diligence during an audit.
- Mapping these device‑level controls to a centralized Trust Center provides auditable proof that the organization monitors, patches, and restricts access to critical infrastructure.
Who Is Affected — Telecommunications providers, ISPs, managed service providers, and any organization that operates internet‑facing routers or IoT gateways.
Recommended Actions
- Conduct an inventory of all internet‑exposed routers and IoT devices.
- Apply vendor‑issued patches for the known CVEs referenced in the botnet’s exploit modules.
- Enforce strict SSH access controls (key‑based auth, MFA) and disable default credentials.
- Deploy continuous network traffic monitoring to detect unauthorized SOCKS5 proxy activity.
- Map these device‑level controls to SOC 2 requirements and capture evidence in a Trust Center for audit readiness.
Source: BleepingComputer – New Evooo1Bot Linux botnet turns routers into traffic relay nodes
Technical Notes
- Botnet reuses Mirai’s DDoS engine; adds encrypted C2 over port 443, SSH brute‑force scanner, credential sniffer, and exploit modules for CVE‑affected products (e.g., Hikvision cameras, Zyxel firewalls, TP‑Link routers, Kubernetes ingress‑nginx, PHP‑CGI).
- Persistence via systemd, SysV init, rc.local, and cron jobs.
- Exploits are sometimes malformed, leading to partial success rates.