Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Evooo1Bot Linux Botnet Hijacks Routers and Firewalls for DDoS, SOCKS5 Proxy and Credential Theft
Malware Families
Excerpt
FortiGuard Labs has uncovered a previously undocumented Linux botnet called Evooo1Bot, named after the “evooo1” string embedded in every malware sample. The threat targets internet-facing routers, firewalls, cameras, and other edge devices, turning compromised systems into tools for DDoS attacks, SOCKS5 proxy relays , credential theft, and further network intrusion. Evooo1Bot borrows its DDoS engine from the leaked Mirai source code but adds a broader set of functions. These…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://91.92.40.118/wget.sh | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…