[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh3Sa7Z7w41_ViS0wlKfC3_yOOl70Sxh3J_peyuV372M":3},{"article":4,"iocs":35,"watch_terms":42,"solutions":43,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":22},"d60986de-ebe3-417e-bb76-6a393fa9c0f4","Linux Botnet Evooo1Bot Expands Mirai Capabilities Well Beyond DDoS","linux-botnet-evooo1bot-expands-mirai-capabilities-well-beyond-ddos-31464e","The botnet adds exploitation modules, credential theft, and reverse SOCKS relays to turn compromised devices into persistent attacker infrastructure.","The Evooo1Bot Linux botnet, an evolution of the Mirai malware, has significantly expanded its capabilities beyond traditional DDoS attacks. It now includes modules for exploiting vulnerabilities, stealing credentials, and establishing reverse SOCKS relays, transforming compromised devices into persistent infrastructure for attackers.","Linux botnet Evooo1Bot expands Mirai capabilities with new exploitation and credential theft modules.","https:\u002F\u002Fwww.darkreading.com\u002Fcyber-risk\u002Flinux-botnet-evooo1bot-mirai-capabilities-beyond-ddos","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt998467101da3f975\u002F6a82f98ac19d9402c559c55d\u002Frobot-army-laurent-davoust-alamy.jpg?width=720&quality=80&disable=upscale","2026-08-17T15:44:34+00:00","2026-08-17T18:00:12.55034+00:00",7,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":19,"name":20,"slug":21},null,"Malware","malware",[23,25,30],{"category":24},{"id":17,"icon":19,"name":20,"slug":21},{"category":26},{"id":27,"icon":19,"name":28,"slug":29},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":31},{"id":32,"icon":19,"name":33,"slug":34},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[36,39],{"type":21,"value":37,"context":38},"Evooo1Bot","Linux botnet name",{"type":21,"value":40,"context":41},"Mirai","Base malware family",[],{"controls":44,"vendors":132},[45,74,103],{"slug":46,"name":47,"problem":48,"products":49},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":75,"name":76,"problem":77,"products":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":104,"name":105,"problem":106,"products":107},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":150},"evooo1bot-botnet-turns-unpatched-linux-devices-into-multi-purpose-attack-infrastructure","Evooo1Bot Botnet Turns Unpatched Linux Devices Into Multi-Purpose Attack Infrastructure","The Evooo1Bot botnet demonstrates how evolved Mirai-based malware now goes far beyond simple DDoS attacks, leveraging known vulnerabilities in unpatched Linux devices to steal credentials, establish persistent reverse proxies, and build long-term attacker infrastructure. The root cause lies in organizations failing to identify and remediate exploitable vulnerabilities in internet-facing Linux systems before threat actors can weaponize them. Once compromised, these devices become persistent footholds that are difficult to detect and evict. This matters because the attack surface has fundamentally shifted — a single unpatched IoT or Linux device can now contribute to credential theft, data exfiltration, and proxy-based anonymization for further attacks, not just volumetric DDoS. Organizations that treat IoT and Linux endpoints as low-priority assets are especially exposed.",[138,139,140,141,142,143,144,145,146,147,148,149],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-40 – Guide to Enterprise Patch Management","NIST SI-2 – Flaw Remediation","NIST SC-7 – Boundary Protection","NIST IA-5 – Authenticator Management (default credentials)","NIST CA-7 – Continuous Monitoring","MITRE ATT&CK T1583.006 – Botnet (Acquire Infrastructure)","MITRE ATT&CK T1110 – Brute Force \u002F Credential Access","ISO\u002FIEC 27001 A.12.6.1 – Management of Technical Vulnerabilities",{}]