Affected Systems
Internet-facing Linux gateway devices (routers, firewalls, edge appliances). Specific vendors and models not disclosed. Mirai-based malware with modular architecture targeting devices with weak credentials or known vulnerabilities.
Exploitation Status
Active campaign in progress. Evooo1Bot is actively targeting and compromising internet-facing gateway devices. No specific CVE disclosed; likely exploiting default credentials, weak passwords, or previously known vulnerabilities common to Mirai variants.
Business Impact
Compromised devices become SOCKS5 proxy nodes, enabling attackers to relay malicious traffic through victim infrastructure. This can facilitate anonymized attacks, credential stuffing, spam distribution, or further lateral movement. Organizations may face IP reputation damage, bandwidth abuse, and potential legal liability for traffic originating from their networks. Detection is challenging as legitimate gateway traffic obscures malicious relay activity.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit all internet-facing Linux gateway devices (routers, firewalls, VPN appliances) for default or weak credentials and enforce strong authentication
- Monitor outbound connections from gateway devices for unusual SOCKS5 proxy traffic (TCP port 1080 or non-standard ports) and unexpected external connections
- Review and restrict management interfaces on edge devices to trusted IP ranges only; disable unnecessary services like Telnet and enable SSH with key-based authentication
- Deploy network segmentation to isolate gateway devices and implement egress filtering to block unauthorized proxy traffic
- Check gateway device logs for signs of compromise including unauthorized login attempts, new user accounts, or unexpected process execution; consider firmware reinstallation if compromise is suspected