Linux Botnet Evooo1Bot Expands Mirai Capabilities Well Beyond DDoS
A new Linux botnet called Evooo1Bot steals passwords and lets attackers hide their own attacks behind infected devices. It builds on Mirai's DDoS power but adds far worse spying and relay tricks.
- Report priority
- Medium
- Targets
- Linux
How it works
A user downloads and runs a fake Linux update or script that secretly installs Evooo1Bot malware on their device.
What to do
Check if your Linux device has unusual SSH login attempts or unknown SSH keys by running sudo grep -i evooo1bot /var/log/auth.log or cat /home/*/.ssh/authorized_keys for suspicious entries.
Update your Linux system immediately via your distro's package manager (e.g., sudo apt update && sudo apt upgrade on Debian/Ubuntu) and remove any unauthorized SSH keys from ~/.ssh/authorized_keys.
Technical details
A user visits a hacked Linux forum and clicks a fake software update link. The script downloads and runs Evooo1Bot, which steals their SSH keys and passwords. Later, the attacker uses the infected device to hide their own hacking tools and launch new attacks from the user's IP.
The botnet adds exploitation modules, credential theft, and reverse SOCKS relays to turn compromised devices into persistent attacker infrastructure.
References
- securityonline.info · evooo1bot-linux-botnet-analysis SecurityOnline
- infosecurity-magazine.com · new-linux-botnet-evooo1bot-victims Infosecurity Magazine