/
← Voltar ao feed
high exploit público

Evooo1Bot: Mirai-based Linux botnet with encrypted C2, 28-command admin interface and reverse SOCKS relay

1 fonte(s) · 1 atualização(ões) · publicado 13/08/2026 10:00 · coletado há 2 dias

FortiGuard Labs describes Evooo1Bot, a Linux botnet that embeds the Mirai DDoS engine in a more modular and capable framework. It uses encrypted C2 communications, layered string obfuscation (AES-256-CTR, ChaCha20, XOR-based key derivation) and a 28-command remote administration interface. It also ships an integrated exploit arsenal against IoT devices, networking equipment and enterprise applications. Its reverse SOCKS relay module is the most operationally significant feature. It turns compromised routers, firewalls, IP cameras and other edge devices into persistent proxies, which lets attackers hide their origin and pivot into internal networks.

14 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2024-10914, CVE-2024-4577, CVE-2023-1389 e outros. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52643 ↗ · remoto · hardware · pub. 17/08/2026 não verificado

    D-Link DNS_340L - OS Command Injection

    This script targets an unauthenticated command injection in the account management CGI of end-of-life D-Link NAS devices (DNS-320, 320LW, 325, 340L). The attacker only needs network access to the device's web interface; no login or user interaction is required. A single crafted request to the user-creation function makes the device run arbitrary operating system commands with root privileges. The code is a working exploit: it verifies the target by running a harmless identity command, offers an interactive command shell, and can scan lists of hosts in parallel. D-Link will not patch, so exposed units should be isolated or retired.

    CVE-2024-10914 · autor: Jared Brits · explicação gerada por IA
  2. exploit-db.com · EDB-52331 ↗ · aplicação web · php · pub. 15/06/2025 não verificado

    PHP CGI Module 8.3.4 - Remote Code Execution (RCE)

    This script exploits CVE-2024-4577, an argument injection flaw in PHP running as CGI on Windows, where a soft hyphen in the query string is turned into a dash and lets the attacker pass configuration options to the interpreter. It needs only network access to an exposed php-cgi executable, with no login or user interaction. The options make PHP run code sent in the request body, giving command execution as the web server user. It looks like a working exploit with multi-host scanning and an interactive shell.

    CVE-2024-4577 · autor: İbrahimsql · explicação gerada por IA
  3. exploit-db.com · EDB-51677 ↗ · remoto · hardware · pub. 10/08/2023 não verificado

    TP-Link Archer AX21 - Unauthenticated Command Injection

    This script exploits CVE-2023-1389, a command injection in the web interface of the TP-Link Archer AX21, where the country setting of the locale handler reaches a shell unsanitized. The attacker needs only network reach to the router's web interface, no login, and firmware older than 1.1.4 Build 20230219. Sending the crafted request twice runs commands as root, and here it opens a reverse shell to the attacker. It is a short but working proof of concept that matches the listed CVE.

    CVE-2023-1389 · autor: Voyag3r · explicação gerada por IA

Detalhes técnicos

  • Obfuscation: multiple layers of string obfuscation using AES-256-CTR, ChaCha20 and XOR-based key derivation.
  • Remote administration: 28 commands, with encrypted C2 traffic.
  • FortiGuard IPS signatures cover exploited flaws including CVE-2007-3010 (Alcatel-Lucent OmniPCX Office), CVE-2016-6277 (NETGEAR), CVE-2018-14558 and CVE-2020-10987 (Tenda AC15), CVE-2019-14931 (Mitsubishi Electric ME-RTU), CVE-2021-36260 (Hikvision), CVE-2021-46422 and CVE-2024-29269 (Telesquare SDT-CW3B1), CVE-2022-26134 (Confluence-style Java EL injection), CVE-2022-29464 (WSO2), CVE-2022-30525 (Zyxel firewall), CVE-2022-37055 (D-Link), CVE-2023-1389 (TP-Link Archer AX21), CVE-2024-10914 (D-Link), CVE-2024-4577 (PHP-CGI), CVE-2025-10123 (D-Link DIR-823X) and CVE-2025-55583 (D-Link DIR-868L).
  • Two SHA-256 hashes are published as indicators.

Remediação

  • Prioritize timely patching of Internet-facing devices and network appliances.
  • Keep firmware up to date.
  • Continuously monitor for suspicious outbound connections.
  • Promptly remediate vulnerable systems.
  • Apply FortiGuard AntiVirus, IPS, Web Filtering (blocks the C2) and IP Reputation/Anti-Botnet protections.

Linha do tempo

  1. feeds.fortinet.com ↗ · pub. 13/08/2026 10:00 · coletado 19/10 18:02 primeiro registro

    Evooo1Bot: Mirai-based Linux botnet with encrypted C2, 28-command admin interface and reverse SOCKS relay

    ler a análise desta fonte

    FortiGuard Labs describes Evooo1Bot, a Linux botnet that embeds the Mirai DDoS engine in a more modular and capable framework. It uses encrypted C2 communications, layered string obfuscation (AES-256-CTR, ChaCha20, XOR-based key derivation) and a 28-command remote administration interface. It also ships an integrated exploit arsenal against IoT devices, networking equipment and enterprise applications. Its reverse SOCKS relay module is the most operationally significant feature. It turns compromised routers, firewalls, IP cameras and other edge devices into persistent proxies, which lets attackers hide their origin and pivot into internal networks.

    Technical Details

    • Obfuscation: multiple layers of string obfuscation using AES-256-CTR, ChaCha20 and XOR-based key derivation.
    • Remote administration: 28 commands, with encrypted C2 traffic.
    • FortiGuard IPS signatures cover exploited flaws including CVE-2007-3010 (Alcatel-Lucent OmniPCX Office), CVE-2016-6277 (NETGEAR), CVE-2018-14558 and CVE-2020-10987 (Tenda AC15), CVE-2019-14931 (Mitsubishi Electric ME-RTU), CVE-2021-36260 (Hikvision), CVE-2021-46422 and CVE-2024-29269 (Telesquare SDT-CW3B1), CVE-2022-26134 (Confluence-style Java EL injection), CVE-2022-29464 (WSO2), CVE-2022-30525 (Zyxel firewall), CVE-2022-37055 (D-Link), CVE-2023-1389 (TP-Link Archer AX21), CVE-2024-10914 (D-Link), CVE-2024-4577 (PHP-CGI), CVE-2025-10123 (D-Link DIR-823X) and CVE-2025-55583 (D-Link DIR-868L).
    • Two SHA-256 hashes are published as indicators.

    Remediation

    • Prioritize timely patching of Internet-facing devices and network appliances.
    • Keep firmware up to date.
    • Continuously monitor for suspicious outbound connections.
    • Promptly remediate vulnerable systems.
    • Apply FortiGuard AntiVirus, IPS, Web Filtering (blocks the C2) and IP Reputation/Anti-Botnet protections.