Yet another Mirai-derived botnet is on the loose, targeting Linux systems by exploiting flaws in various Internet-facing devices to combine distributed denial of service (DDoS) attacks with a broader set of malicious capabilities.
The botnet, tracked as "Evooo1Bot" by the research team at Fortiguard Labs, has been actively targeting Internet-facing devices — including equipment from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link — since at least July, according to a report published Friday.
"Evooo1Bot is a Linux botnet family that incorporates the Mirai DDoS engine into a significantly more capable and modular framework," Fortiguard Labs threat researcher Cara Lin explained in the report.
The researchers named the botnet — which exploits a host of vulnerabilities as old as 2007 as well as flaws discovered just last year — after finding the hardcoded string "evooo1" in every binary. Evooo1Bot reuses the DDoS engine from the publicly leaked Mirai source code, but goes much further than that, giving attackers a multifunctional platform for compromising and monetizing vulnerable Linux-based devices, she said.