Security· August 17, 2026 at 03:44 p.m.
Linux Botnet Evooo1Bot Enhances Attack Capabilities Beyond DDoS
Key takeaways
- Evooo1Bot is a new Linux botnet
- It expands upon Mirai's capabilities
- It adds exploitation modules, credential theft, and reverse SOCKS relays
A new Linux botnet, named Evooo1Bot, has been discovered that expands upon the capabilities of the Mirai botnet. Unlike Mirai, which primarily focuses on launching distributed denial-of-service (DDoS) attacks, Evooo1Bot adds exploitation modules, credential theft, and reverse SOCKS relays to turn compromised devices into long-term attacker infrastructure.
The botnet is believed to have been active since at least October 2021. Researchers from the Cyber Threat Alliance (CTA) discovered it while investigating a DDoS attack on one of their member organizations.
'Evooo1Bot represents a significant evolution in the threat landscape, as it leverages Linux systems to create a more persistent and versatile attack platform,' said John Bambenek, CTA board chair and threat intelligence team leader at Netenrich.
