A newly identified Linux-based botnet, dubbed Evooo1Bot, is actively compromising internet-facing edge devices by exploiting known vulnerabilities and weak SSH credentials. Once infiltrated, these devices are co-opted for distributed denial-of-service (DDoS) attacks, remote access, and traffic relaying, posing significant risks to both the compromised systems and broader network infrastructures.
Comprehensive Attack Arsenal
Evooo1Bot integrates code from the notorious Mirai botnet framework, enhancing its capabilities beyond standard DDoS operations. The malware supports 16 distinct DDoS attack methods, including UDP, DNS, SYN, GRE, and fragmented TCP floods. Notably, its HTTP flood function allows operators to customize request methods and headers, making malicious traffic less detectable.
Beyond DDoS functionalities, Evooo1Bot features an exploit dispatcher targeting vulnerabilities in devices from manufacturers such as D-Link, Tenda, Hikvision, Zyxel, and TP-Link. While some exploit attempts may be ineffective, the botnet’s broad targeting underscores the critical need for timely firmware updates and robust patch management practices.
Persistence and Evasion Techniques
Upon successful infiltration, Evooo1Bot employs various methods to maintain persistence on the compromised device. These include modifying system services, startup scripts, scheduled tasks, shell profiles, and the rc.local file. Additionally, the malware is designed to detect analysis tools, sandboxes, virtual machines, and containerized environments, enabling it to evade detection and analysis.
SOCKS5 Proxy Functionality
A particularly concerning feature of Evooo1Bot is its SOCKS5 proxy module, which allows attackers to relay malicious traffic through infected devices. In direct mode, the bot opens a SOCKS5 listener, typically on TCP port 1080. In reverse mode, it establishes encrypted outbound connections to attacker-controlled relay servers, effectively masking the origin of malicious activities and facilitating access to networks behind compromised devices.
Credential Harvesting and Network Propagation
Evooo1Bot includes an SSH scanner equipped with over 150 embedded credentials, including common service account names used in enterprise environments. This scanner attempts to brute-force SSH access to additional devices, enabling the botnet to propagate within networks. Furthermore, the malware features a sniffer capable of capturing HTTP Basic Authorization and Cookie headers, potentially leading to further credential compromise and unauthorized access.
The emergence of Evooo1Bot highlights the evolving sophistication of botnets targeting edge devices. Organizations must prioritize securing internet-facing systems by applying timely firmware updates, enforcing strong, unique administrative credentials, and monitoring for unusual outbound connections. Proactive defense measures are essential to mitigate the risks posed by such multifaceted threats.
