2026-08-16 · view entry permalink →
Evooo1Bot: a Mirai-derived Linux botnet whose exploit arsenal reaches Confluence, WSO2 and Kubernetes ingress-nginx, and whose SSH dictionary is stocked with enterprise service accounts rather than router defaults
FortiGuard Labs has documented Evooo1Bot, a previously undocumented Mirai-derived Linux botnet named after a hardcoded string present in every sample and active since at least July 2026 on the firm's own intrusion-prevention telemetry (FortiGuard Labs, 2026-08-13). It reuses the leaked Mirai denial-of-service engine, but the researchers' summary is that it extends that framework with encrypted command-and-control, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer and an integrated exploit arsenal (BleepingComputer, 2026-08-15).
The reason this is not just another Mirai fork is what the exploit module can reach. Most of its chain is the expected consumer and small-office set — NETGEAR, Tenda, TP-Link and D-Link routers and network storage, Hikvision cameras, Telesquare gateways, and an OT remote terminal unit from Mitsubishi Electric. But three of its modules target enterprise-class, internet-facing systems that sit inside European public-sector and critical-infrastructure estates: the Atlassian Confluence OGNL injection (CVE-2022-26134), the WSO2 unrestricted-file-upload path to code execution (CVE-2022-29464), and the Kubernetes ingress-nginx admission-controller flaw (CVE-2025-1974), alongside PHP-CGI argument injection on Windows (CVE-2024-4577) and a Zyxel firewall command injection (FortiGuard Labs, 2026-08-13). One module is a false alarm and worth naming so nobody rediscovers it and panics: the bundled Progress MOVEit Transfer code passes a payload argument without performing the upload procedure, and FortiGuard states such modules are non-exploitable as shipped (FortiGuard Labs, 2026-08-13).
The credential dictionary points the same way. FortiGuard records over 150 entries, and notes that beyond typical IoT defaults the list carries service-account names — jenkins, postgres, oracle, nagios, deploy — that are more common in enterprise and operations-technology environments than on consumer routers (FortiGuard Labs, 2026-08-13). The brute-forcer also screens its targets twice: it compares the SSH banner against a hardcoded list of research honeypot frameworks before attempting credentials, then after login runs a short probe reading kernel version and process-one command line and listing known honeypot install paths, aborting if the host does not answer like a real system (FortiGuard Labs, 2026-08-13).
What the operator does with a foothold is the second half. The bot runs a SOCKS5 relay — a direct listener plus a reverse mode that separates a persistent encrypted control channel from per-session proxy data — and an HTTP credential sniffer that parses the kernel's TCP connection table to lift Basic-Auth and cookie headers into a local log. FortiGuard's framing is that transforming a compromised router into a persistent proxy lets attackers conceal their true origin and pivot into internal networks (FortiGuard Labs, 2026-08-13). Command-and-control is encrypted and runs over TCP/443, a port FortiGuard notes is chosen to blend in with expected HTTPS traffic at the network perimeter; the researchers do not name the cipher that channel uses, though they do describe AES-256-CTR, ChaCha20 and XOR-based key derivation protecting the sample's own strings, with each key split into two constants combined at runtime. Persistence is stacked deliberately: a systemd unit impersonating an Apache cache-manager service with automatic restart, a SysV init script, a cron entry re-fetching the loader every five minutes, a profile.d injection and an rc.local append, with the process raising its own out-of-memory score adjustment and holding the watchdog device open to survive reboots and memory pressure (FortiGuard Labs, 2026-08-13).
Triage: the discriminators are placement rather than signature. An application server or an ingress controller is built to receive connections, so the anomaly is that host originating outbound sessions on 443 that do not correspond to any configured integration — inbound-only services initiating egress is the signal, and the encrypted transport means content inspection will not help. On embedded appliances, the persistence stack itself is the tell: a device that normally carries no cron entries, no profile.d scripts and no custom systemd units suddenly carrying all of them at once is far outside its own baseline, and the impersonating service name is designed to survive a quick eyeball rather than a comparison against what that appliance actually runs. In authentication logs, a single source cycling many distinct enterprise service-account names separates this from legitimate automation, which authenticates as one expected account. One caution for teams running SSH deception: this component fingerprints honeypots before and after login and aborts when it detects one, so silence from a deception asset is not evidence that scanning has stopped.
The embedded credential dictionary contains over 150 entries. Beyond typical IoT default credentials, the list includes service account names (jenkins, postgres, oracle, nagios, deploy) that are more common in enterprise and operations-technology environments than on consumer routers.
the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities