Linux Botnet Turns Devices Including Routers Into Persistent Attacker Infrastructure

A newly identified Linux botnet is exploiting years-old security vulnerabilities to compromise routers, firewalls, IP cameras and other internet-facing systems, transforming them into a distributed infrastructure for cyberattacks, credential theft and covert traffic relaying.

The malware, named Evooo1Bot, is based partly on the leaked source code of the notorious Mirai botnet. However, researchers say the operators have expanded the familiar Mirai formula into a much broader remote-access platform with encrypted command-and-control communications, persistent access, an interactive shell, file-transfer functions, an SSH brute-force scanner and a SOCKS5 proxy service.