Mirai‑Derived Evooo1Bot Botnet Hijacks Linux Routers and IoT Devices via 18 CVEs
What Happened — Fortinet’s FortiGuard Labs disclosed a new Linux‑based botnet, Evooo1Bot, that repurposes Mirai’s DDoS engine and adds encrypted C2, an SSH brute‑force scanner, a credential sniffer, and a SOCKS5 proxy. The botnet exploits 18 known router/IoT vulnerabilities (CVE‑2007‑3010 through CVE‑2025‑55583) and hides its traffic on port 443.
Why It Matters for Compliance & Audit Readiness
- The attack chain hinges on weak credential hygiene and unpatched devices—exactly the gaps SOC 2 Access Controls (CC6.1) are designed to detect and evidence.
- Continuous monitoring of privileged access and network egress (port 443) provides the audit‑ready logs needed to prove reasonable safeguards.
Who Is Affected – Telecommunications, manufacturing, smart‑home vendors, and any organization that deploys Linux‑based routers or IoT gateways.
Recommended Actions –
- Map the incident to SOC 2 CC6.1 (Logical Access) and CC7.1 (System Operations) controls.
- Enforce MFA or key‑based SSH authentication and rotate credentials regularly.
- Deploy a vulnerability‑management program that prioritizes the 18 CVEs cited.
- Implement network‑traffic analytics to flag encrypted outbound flows on port 443 from non‑web assets.
Source: Security Affairs
Technical Notes – Evooo1Bot uses an encrypted C2 channel over HTTPS, clears Bash history after infection, and can act as a proxy to mask malicious traffic. Exploited CVEs span remote code execution, command injection, and buffer overflows across routers from Alcatel, NETGEAR, Tenda, D‑Link, Mitsubishi, and others. Source: FortiGuard Labs report