Loading story…
FortiGuard Labs disclosed a previously undocumented Linux botnet, Evooo1Bot, a Mirai-derived malware family that has been actively targeting Internet-facing devices since at least July 2026. The botnet exploits known vulnerabilities in routers, firewalls, IP cameras, and other edge hardware from vendors including Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda, and Telesquare, then deploys architecture-specific binaries from a shared loader at 91.92.40[.]118. Researchers said the malware clears bash history after infection, performs anti-analysis and anti-sandbox checks, and communicates with its command-and-control infrastructure over encrypted channels on port 443.
Evooo1Bot expands on typical Mirai behavior with SSH brute-force scanning, credential sniffing for default or exposed access credentials, persistence mechanisms, and an integrated exploit module for multiple known flaws. Researchers highlighted its reverse SOCKS proxy capability as the most consequential feature because compromised edge devices can be repurposed as long-lived relay nodes to conceal attacker origin, support lateral movement, and enable follow-on intrusions into internal networks. Reported activity has been concentrated across North America, South America, Europe, India, China, and Japan, underscoring broad exposure for organizations running unpatched perimeter devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs said telemetry from Evooo1Bot command-and-control infrastructure showed the botnet had been actively targeting Internet-facing devices since July 2026. The activity involved exploitation attempts against multiple known vulnerabilities with payload callbacks to a common loader URL.
The Mirai botnet source code was publicly released in 2016, enabling numerous later malware variants. Evooo1Bot is described as one such Mirai-derived descendant.
FortiGuard Labs reported a previously undocumented Linux botnet family named Evooo1Bot and detailed its Mirai-derived architecture, encrypted C2, SSH brute-force scanning, SOCKS proxying, credential sniffing, persistence, and exploit modules. The report also stated FortiGuard security products detect or block the malware and associated infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcetherecord.media
Open sourcefeeds.fortinet.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026
A renewed **Mirai** botnet campaign is targeting internet-exposed routers and IoT devices by exploiting known vulnerabilities, with advisories highlighting compromises affecting industrial routers, smart home systems, DVRs, cameras, and 5G/LTE equipment. Reported targets include devices from **ASUS, Huawei, Neterbit, LB-Link, Four-Faith, Kguard, Lilin,** and **Vimar**, as well as generic DVR platforms and PZT cameras, indicating broad opportunistic scanning of exposed edge infrastructure. National CERT advisories from Brunei and Colombia warned that Mirai-related botnet activity continues to threaten consumer and industrial environments, including routers and other connected devices. Defenders were urged to **patch exposed systems**, **disable remote access where possible**, **replace default credentials with strong unique passwords**, and **scan networks for vulnerable or internet-facing assets** to reduce the risk of botnet enrollment and downstream abuse such as distributed denial-of-service activity.
Aug 1, 2026
Fortinet and other reporting identified **Nexcorium**, a Mirai-derived malware strain targeting Internet of Things devices, particularly **TBK DVR-4104** and **DVR-4216** video recorder systems used with security cameras. The campaign exploits **`CVE-2024-3721`**, an OS command injection flaw, to run a downloader script that retrieves malware binaries for multiple Linux architectures. Fortinet linked the activity to a suspected actor it calls **Nexus Team**, citing the custom HTTP header `X-Hacked-By: Nexus Team – Exploited By Erratic.` Once installed, Nexcorium uses classic Mirai-style scanner, watchdog, and attack modules, establishes persistence through mechanisms including init, `rc.local`, systemd, and cron, and spreads further through brute-force Telnet activity, default-password abuse, and exploitation of **`CVE-2017-17215`** in Huawei HG532 devices. The malware performs self-checks, replication, and self-deletion to improve resilience and evasion, then connects to the command-and-control domain `r3brqw3d[.]b0ats[.]top` to receive instructions for **DDoS** operations, including UDP, TCP SYN, TCP ACK, SMTP, and VSE query floods.
Jun 29, 2026