A new Linux botnet targets routers and other devices on the edge of corporate networks. Evooo1Bot can not only use infected systems for DDoS attacks but also use them as proxies for other internet traffic. This lets attackers route their activities through victims’ IP addresses.
This was reported by BleepingComputer. Researchers at Fortinet have been tracking the malware since July. Evooo1Bot is based on Mirai, but its creators have expanded the well-known botnet code with various modules. For example, the malware can intercept login credentials, attack SSH accounts, and establish SOCKS5 connections.
Exploiting known vulnerabilities
For initial infection, Evooo1Bot exploits existing vulnerabilities in devices directly accessible from the internet. Fortinet observed attacks on equipment from manufacturers including Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link.
A separate exploit module expands the number of potential targets. It includes attacks on, among others, Hikvision cameras, Zyxel firewalls, TP-Link routers, D-Link NAS systems, Atlassian Confluence, WSO2 products, Kubernetes ingress-nginx, and PHP-CGI installations. According to Fortinet, however, not all exploits function as intended.
After a successful attack, the malware automatically downloads a suitable version. The developers have created twelve variants for different processor architectures. Evooo1Bot then clears the Bash history to limit traces of the infection.
The malware also actively attempts to prevent analysis. Before execution, Evooo1Bot checks for virtual machines, containers, sandboxes, honeypots, debuggers, and security software, among other things. It uses encrypted traffic over port 443 to communicate with the C2 infrastructure.
Router becomes proxy server
The SOCKS5 functionality, in particular, makes Evooo1Bot more versatile than a traditional DDoS botnet. An infected device can serve as a relay for internet traffic. As a result, malicious activity appears to originate from the victim’s network rather than the attacker.
Multiple proxy sessions can run simultaneously and independently. Fortinet points out that a sufficiently large botnet can therefore also become commercially attractive for residential proxy services. Such networks offer IP addresses from regular internet connections as the source of traffic.
In addition, Evooo1Bot attempts to extract credentials from network traffic. To do this, the malware checks /proc/net/tcp and searches for, among other things, HTTP Basic Authentication data and cookie headers. An SSH module attempts to gain access to other systems using 150 combinations of usernames and passwords.
The original Mirai functionality has also been retained. Evooo1Bot has sixteen DDoS attack methods, including SYN, UDP, DNS, ACK, and HTTP floods.
Once installed, the malware attempts to persist via various Linux mechanisms, including systemd, SysV init, and rc.local. A cron job also attempts to re-download the malware every five minutes. This means that simply removing the active process is insufficient to permanently clean an infected device.