Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies

The investigation first tested whether the news report represented a new campaign or merely a compilation of historically exploited CVEs. Fortinet's primary research established a distinct Linux botnet and confirmed observed exploitation of ten vulnerabilities from July 2026, while documenting eight further CVE handlers whose successful use was not established. CISA, Kubernetes and public-code records corroborated historical exploitation, affected-component and PoC claims but did not independently identify Evooo1Bot, leaving campaign scale and attribution unresolved.

1. What event and timeline did the initial report claim?
   Reviewed the supplied news article and separated observed malware delivery from capabilities merely found in the binary.
   thehackernews.com ↗

   The article reported a Mirai-derived Linux botnet active since July 2026, with ten vulnerabilities used for delivery and eight additional vulnerabilities represented in an exploit module.

   why This established the claims requiring primary-source verification and prevented treating all 18 CVEs as equally evidenced active exploitation.

2. Did primary technical evidence confirm the malware, exploitation and operational indicators?
   Read Fortinet's complete technical report, including discovery, functional modules, exploit-table limitations, protections and indicators.

   Fortinet observed exploit attempts for ten CVEs leading to 91.92.40[.]118/wget.sh, analysed 12 Linux builds and documented encrypted command-and-control, SOCKS5 relay, SSH scanning, credential sniffing, persistence and denial-of-service functions. It also warned that some exploit-table entries are non-functional as implemented.

   why This is the strongest campaign evidence and supports confirmed active exploitation only for the vulnerabilities seen in traffic, not every handler embedded in the malware.

3. Was exploitation history independently established for any vulnerability in the additional exploit module?
   Queried the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog for CVE-2024-4577.

   CISA records CVE-2024-4577 as an exploited PHP-CGI operating-system command-injection vulnerability, added on 12 June 2024, with known ransomware use.

   why This independently confirms historical exploitation risk but does not show that Evooo1Bot successfully used its CVE-2024-4577 handler in the current campaign.

4. What is the supported scope and remediation for the Kubernetes vulnerability named in the malware?
   Reviewed the Kubernetes Security Response Committee's CVE-2025-1974 advisory.
   kubernetes.io ↗

   The issue affects ingress-nginx's Validating Admission Controller and was fixed in ingress-nginx 1.12.1 and 1.11.5; disabling that controller is documented as a temporary mitigation.

   why This supplies authoritative product scope and remediation while highlighting that Fortinet's discovery of a handler is not evidence of successful exploitation against Kubernetes clusters.

5. Was there actor-specific or public-code discussion associated with the stated OSINT record?
   Inspected the supplied deepdarkCTI record for the related Confluence vulnerability.
   raw.githubusercontent.com ↗

   The record lists CVE-2022-26134 as Confluence remote code execution and links a public proof-of-concept repository, but contains no Evooo1Bot-specific actor, victim or marketplace discussion.

   why This supports PoC availability only and prevents overstating a general community list as campaign-specific threat-actor chatter.

6. Does the referenced CVE-2022-26134 proof of concept actually exist and match the vulnerability?
   Opened and reviewed the linked public GitHub repository.
   github.com ↗

   The repository contains public Python exploit code described as a Confluence pre-authentication OGNL-injection proof of concept and was published years before Evooo1Bot.

   why This verifies public exploit availability while showing that the code's existence neither attributes the botnet nor proves its use in a particular Evooo1Bot intrusion.