Evooo1Bot: a Mirai-derived Linux botnet whose exploit arsenal reaches Confluence, WSO2 and Kubernetes ingress-nginx, and whose SSH dictionary is stocked with enterprise service accounts rather than router defaults
FortiGuard Labs has documented Evooo1Bot, a previously undocumented Mirai-derived Linux botnet named after a hardcoded string present in every sample and active since at least July 2026 on the firm's own intrusion-prevention telemetry (FortiGuard Labs, 2026-08-13). It reuses the leaked Mirai denial-of-service engine, but the researchers' summary is that it extends that framework with encrypted command-and-control, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer and an integrated exploit arsenal (BleepingComputer, 2026-08-15).
The reason this is not just another Mirai fork is what the exploit module can reach. Most of its chain is the expected consumer and small-office set — NETGEAR, Tenda, TP-Link and D-Link routers and network storage, Hikvision cameras, Telesquare gateways, and an OT remote terminal unit from Mitsubishi Electric. But three of its modules target enterprise-class, internet-facing systems that sit inside European public-sector and critical-infrastructure estates: the Atlassian Confluence OGNL injection (CVE-2022-26134), the WSO2 unrestricted-file-upload path to code execution (CVE-2022-29464), and the Kubernetes ingress-nginx admission-controller flaw (CVE-2025-1974), alongside PHP-CGI argument injection on Windows (CVE-2024-4577) and a Zyxel firewall command injection (FortiGuard Labs, 2026-08-13). One module is a false alarm and worth naming so nobody rediscovers it and panics: the bundled Progress MOVEit Transfer code passes a payload argument without performing the upload procedure, and FortiGuard states such modules are non-exploitable as shipped (FortiGuard Labs, 2026-08-13).
The credential dictionary points the same way. FortiGuard records over 150 entries, and notes that beyond typical IoT defaults the list carries service-account names — jenkins, postgres, oracle, nagios, deploy — that are more common in enterprise and operations-technology environments than on consumer routers (FortiGuard Labs, 2026-08-13). The brute-forcer also screens its targets twice: it compares the SSH banner against a hardcoded list of research honeypot frameworks before attempting credentials, then after login runs a short probe reading kernel version and process-one command line and listing known honeypot install paths, aborting if the host does not answer like a real system (FortiGuard Labs, 2026-08-13).
What the operator does with a foothold is the second half. The bot runs a SOCKS5 relay — a direct listener plus a reverse mode that separates a persistent encrypted control channel from per-session proxy data — and an HTTP credential sniffer that parses the kernel's TCP connection table to lift Basic-Auth and cookie headers into a local log. FortiGuard's framing is that transforming a compromised router into a persistent proxy lets attackers conceal their true origin and pivot into internal networks (FortiGuard Labs, 2026-08-13). Command-and-control is encrypted and runs over TCP/443, a port FortiGuard notes is chosen to blend in with expected HTTPS traffic at the network perimeter; the researchers do not name the cipher that channel uses, though they do describe AES-256-CTR, ChaCha20 and XOR-based key derivation protecting the sample's own strings, with each key split into two constants combined at runtime. Persistence is stacked deliberately: a systemd unit impersonating an Apache cache-manager service with automatic restart, a SysV init script, a cron entry re-fetching the loader every five minutes, a profile.d injection and an rc.local append, with the process raising its own out-of-memory score adjustment and holding the watchdog device open to survive reboots and memory pressure (FortiGuard Labs, 2026-08-13).
Triage: the discriminators are placement rather than signature. An application server or an ingress controller is built to receive connections, so the anomaly is that host originating outbound sessions on 443 that do not correspond to any configured integration — inbound-only services initiating egress is the signal, and the encrypted transport means content inspection will not help. On embedded appliances, the persistence stack itself is the tell: a device that normally carries no cron entries, no profile.d scripts and no custom systemd units suddenly carrying all of them at once is far outside its own baseline, and the impersonating service name is designed to survive a quick eyeball rather than a comparison against what that appliance actually runs. In authentication logs, a single source cycling many distinct enterprise service-account names separates this from legitimate automation, which authenticates as one expected account. One caution for teams running SSH deception: this component fingerprints honeypots before and after login and aborts when it detects one, so silence from a deception asset is not evidence that scanning has stopped.
The embedded credential dictionary contains over 150 entries. Beyond typical IoT default credentials, the list includes service account names (jenkins, postgres, oracle, nagios, deploy) that are more common in enterprise and operations-technology environments than on consumer routers.
the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities
Defender actions
- Check whether any internet-facing Atlassian Confluence, WSO2 product or Kubernetes ingress-nginx admission controller in the estate is still on a version vulnerable to CVE-2022-26134, CVE-2022-29464 or CVE-2025-1974 — these are now in a commodity botnet's automated scanning arsenal rather than only a targeted-actor concern, so an instance that survived on obscurity no longer does.
ATT&CK mapping
13 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Resource Development TA0042
T1584.005Compromise Infrastructure: Botnet
Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks. Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems. Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers. With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1053.003Scheduled Task/Job: Cron
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.
Persistence TA0003
T1037.004Boot or Logon Initialization Scripts: RC Scripts
Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.
T1053.003Scheduled Task/Job: Cron
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.
T1543.002Create or Modify System Process: Systemd Service
Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
T1546.004Event Triggered Execution: Unix Shell Configuration Modification
Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (<code>/etc</code>) and the user’s home directory (<code>~/</code>) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Privilege Escalation TA0004
T1037.004Boot or Logon Initialization Scripts: RC Scripts
Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.
T1053.003Scheduled Task/Job: Cron
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.
T1543.002Create or Modify System Process: Systemd Service
Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources. Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
T1546.004Event Triggered Execution: Unix Shell Configuration Modification
Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (<code>/etc</code>) and the user’s home directory (<code>~/</code>) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
T1497.001Virtualization/Sandbox Evasion: System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Credential Access TA0006
T1040Network Sniffing
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
T1110.001Brute Force: Password Guessing
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.
Discovery TA0007
T1040Network Sniffing
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
T1497.001Virtualization/Sandbox Evasion: System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Command and Control TA0011
T1090.002Proxy: External Proxy
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.
T1573Encrypted Channel
Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Impact TA0040
T1498Network Denial of Service
Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.