[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faY8fyHOuGmGvYDaizn21dRFk8Nii1aPlQSgctfQNWUE":3},{"article":4,"iocs":48,"watch_terms":56,"solutions":57,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"fd1d38ab-b512-4b9f-bf5b-8aba70aadab5","New Evooo1Bot Linux botnet turns routers into traffic relay nodes","new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes-2ef1bb","A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. [...]","A new Mirai-based Linux botnet, Evooo1Bot, is targeting internet-facing gateway devices like routers, converting them into SOCKS5 traffic relay nodes. Beyond proxying, it can steal credentials, perform SSH brute-forcing, and launch DDoS attacks by exploiting known vulnerabilities in devices from various manufacturers.","New Evooo1Bot Linux botnet targets routers, turning them into SOCKS5 proxy nodes.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F11\u002F01\u002Fbotnet-kill-switch.jpg","2026-08-15T14:14:38+00:00","2026-08-15T16:00:10.257079+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Alcatel routers","product",{"name":21,"type":19},"NETGEAR routers",{"name":23,"type":19},"Tenda routers",{"name":25,"type":19},"Mitsubishi Electric devices",{"name":27,"type":19},"Telesquare devices",{"name":29,"type":19},"D-Link devices","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,52],{"type":34,"value":50,"context":51},"Evooo1Bot","Name of the new Mirai-based Linux botnet.",{"type":53,"value":54,"context":55},"ip","443","Port used for encrypted C2 communications.",[18,21,23],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":118,"name":119,"problem":120,"products":121},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":168},"mirai-based-botnet-hijacks-routers-via-known-vulnerabilities","Mirai-Based Botnet Hijacks Routers via Known Vulnerabilities","The Evooo1Bot botnet exploits known, unpatched vulnerabilities in internet-facing routers and gateway devices to conscript them into a SOCKS5 proxy network used for credential theft, DDoS attacks, and SSH brute-forcing. The root cause is a failure to patch and harden edge devices that are directly exposed to the internet — a persistent and well-understood risk. Many organizations neglect firmware and appliance patching with the same rigor applied to servers and workstations, leaving routers as soft targets. This matters because compromised routers provide attackers with a trusted, internal vantage point to pivot deeper into networks and obfuscate malicious traffic origins.",[158,159,160,161,162,163,164,165,166,167],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AC-17: Remote Access","NIST CSF DE.CM-1: Network Monitoring","NIST CSF ID.AM-1: Asset Inventory","MITRE ATT&CK T1090: Proxy — Multi-hop Proxy","MITRE ATT&CK T1110: Brute Force",{}]