A sophisticated Linux botnet, dubbed Evooo1Bot, has been discovered exploiting known vulnerabilities to hijack edge devices and turn them into SOCKS5 proxies. This malicious network is capable of bypassing traditional security measures and could be used for a wide range of nefarious activities, from data exfiltration to DDoS attacks.
Evooo1Bot specifically targets Linux-based systems, including IoT devices, servers, and other edge devices that are often left exposed to the internet. Once compromised, these devices can be remotely controlled by the botnet’s operators, who use them to create a network of SOCKS5 proxies. These proxies allow attackers to mask their IP addresses, making it difficult for security systems to detect and block malicious traffic.
The botnet exploits known vulnerabilities in various Linux distributions, including Ubuntu, Debian, and CentOS. The exact number of affected devices is unknown at this time, but researchers warn that the potential scope is vast, given the widespread use of these operating systems in IoT devices and edge computing environments. In fact, a recent study found that over 70% of IoT devices are vulnerable to common Linux exploits.
To understand how Evooo1Bot works, consider the process of creating a SOCKS5 proxy. When an attacker compromises a device, they install a specialized tool that allows them to tunnel internet traffic through the compromised system. This creates a secure connection between the attacker’s machine and the victim’s network, effectively masking their IP address. The compromised devices are then used as relays for further attacks or data exfiltration.
The implications of Evooo1Bot are significant, given the increasing reliance on IoT devices and edge computing in modern networks. As these devices become more interconnected and exposed to the internet, they also create new entry points for attackers. If left unpatched or poorly configured, even a single compromised device can put an entire network at risk.
In light of this discovery, it’s essential for system administrators and security professionals to prioritize patching known vulnerabilities in Linux distributions and ensuring proper configuration of IoT devices. Regular network scans and penetration testing can also help identify potential entry points before they’re exploited by attackers. By staying vigilant and proactive, we can reduce the likelihood of our networks being compromised by sophisticated botnets like Evooo1Bot.
Source: The Hacker News — 2026-08-17