Evooo1Bot Modular Linux Botnet

Evooo1Bot is a newly analyzed modular Linux-based botnet identified by FortiGuard Labs. The threat actor leverages this malware to compromise internet-facing devices, converting them into active nodes within a botnet infrastructure. The botnet is notable for its multi-functional design, which supports a variety of malicious activities including distributed denial-of-service (DDoS) attacks, automated brute-force attempts against SSH services, the exploitation of known vulnerabilities to achieve initial access, and the utilization of infected hosts as SOCKS proxy relays to mask and redirect malicious traffic. This botnet targets a broad range of Linux-based devices, emphasizing the need for robust hardening of perimeter-facing services and strong credential management for administrative interfaces.

Impact

Successful compromise by Evooo1Bot results in the loss of device integrity, the potential for unauthorized network transit via SOCKS proxying, and the use of the device as a participant in wider DDoS attacks. The scope of impact includes potential service disruption, unauthorized access to internal resources, and increased risk of follow-on attacks originating from the local network.

Recommendation

Detection engineering teams should focus on identifying unauthorized administrative access attempts and anomalous network traffic associated with SOCKS proxies.

• Implement monitoring for repeated failed SSH login attempts from diverse external IP addresses.
• Baseline network traffic for high volumes of outbound connections on common proxy ports.
• Audit internet-facing devices to ensure that all services are patched against known remote code execution vulnerabilities.
• Restrict inbound SSH access to required management jump hosts or use multi-factor authentication for all remote access.