Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies

A previously undocumented Linux botnet family, Evooo1Bot, has been flagged by cybersecurity researchers. The malware's core code derives from the Mirai botnet source code that was publicly leaked, and it has been enhanced with the ability to turn internet‑facing edge devices into SOCKS5 proxies. While the underlying DDoS engine remains that of Mirai, the operators have added functionality to route traffic through compromised devices, potentially enabling anonymized malicious activity, further intrusion, and lateral movement within networks. The botnet exploits known vulnerabilities in edge devices; no zero‑day exploits have been identified. The exact list of targeted vulnerabilities has not been specified in the initial reporting, but the reliance is on unpatched flaws. Compromised devices may be used to obfuscate the origin of attack traffic and facilitate additional cyber‑enabled crimes. The emergence of Evooo1Bot underscores the ongoing risk posed by unpatched edge infrastructure and the reuse of leaked botnet code to rapidly develop new threat capabilities.