Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
1 IOC

Evooo1Bot Linux Botnet Hijacks Routers and Firewalls for DDoS, SOCKS5 Proxy and Credential Theft

Cyber Press
Cyber Press
Published August 17, 2026Original Report

Malware Families

Excerpt

FortiGuard Labs has uncovered a previously undocumented Linux botnet called Evooo1Bot, named after the “evooo1” string embedded in every malware sample. The threat targets internet-facing routers, firewalls, cameras, and other edge devices, turning compromised systems into tools for DDoS attacks, SOCKS5 proxy relays , credential theft, and further network intrusion. Evooo1Bot borrows its DDoS engine from the leaked Mirai source code but adds a broader set of functions. These…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREhttp://91.92.40.118/w…CAPABILITYMiraiXorDDoSVICTIMunknown
Adversary
Infrastructure(1)
Capability(2)
Victim

Indicators of Compromise

Open the mindmap →

1 indicators

TypeIndicatorConfidenceScoreFirst Seen
URLhttp://91.92.40.118/wget.shHighScore 86/100First seen

IOC Relationship Graph

Building graph…