Overview
- Security teams disclosed Evooo1Bot after tracking activity that dates back to July 2026 and published technical findings in mid-August showing a previously undocumented Mirai-derived family.
- The botnet gains access by exploiting a wide set of known CVEs across routers, cameras and edge appliances and then runs a loader script hosted at 91.92.40.118 that pulls a CPU‑specific binary and clears Bash history.
- After installation the binary performs sandbox checks and opens an encrypted command‑and‑control channel over port 443 to blend with HTTPS traffic before accepting operator commands.
- Operators can enable a SOCKS5 proxy module (with direct listener and reverse relay modes) and use infected devices to anonymize traffic, bypass geo‑blocks, access internal networks or sell proxy access.
- The malware also reuses Mirai’s DDoS engine and adds an SSH brute‑force scanner, credential sniffer, HTTP exploit dispatcher and persistence controls, so owners should patch devices, change default credentials, and limit internet exposure.