Cybersecurity researchers report a Linux botnet family called Evooo1Bot that uses leaked Mirai source code as a base and compromises internet-facing devices. The malware’s core functionality includes turning infected edge systems into SOCKS5 proxies, enabling network traffic to be relayed through compromised hosts.
According to reports, Evooo1Bot goes beyond Mirai’s original focus on distributed denial-of-service activity. Analysts describe added modules that support exploiting known software flaws to gain initial access, and additional capabilities such as credential theft. Dark Reading also characterizes the botnet as adding reverse SOCKS relays, supporting persistent attacker infrastructure even after initial compromise.
Across outlets, the central points align: Evooo1Bot is derived from Mirai, targets Linux-based devices, and expands functionality toward proxying rather than only DDoS. Both sources emphasize that the botnet reuses Mirai’s code while extending it with extra features for exploitation and maintaining control.
