New Evooo1Bot Linux botnet turns routers into traffic relay nodes
A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. The malware's capabilities extend beyond turning devices into proxy nodes and include credential theft, SSH br…
Intelligence analysis by Llama
Evooo1Bot is a Mirai-based modular Linux botnet malware that targets internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. It has capabilities beyond proxying, including credential theft, SSH brute-forcing, and DDoS attacks.
Imagine you have a supercomputer that can do lots of things at the same time. Evooo1Bot is like a program that takes over these supercomputers and uses them to do bad things, like sending lots of fake messages to websites or stealing people's passwords. It's like a robot that can do lots of tasks, but it's being used for evil purposes.
Analysis
Evooo1Bot's Capabilities and Spread
Evooo1Bot is a Mirai-based modular Linux botnet malware that has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. The malware's capabilities extend beyond turning devices into proxy nodes and include credential theft, SSH brute-forcing, and launching distributed denial-of-service (DDoS) attacks. Since at least July, Evooo1Bot has been targeting devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link across various regions by exploiting known vulnerabilities.
Exploitation and Persistence
Evooo1Bot uses encrypted command-and-control (C2) communications over port 443 and performs extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots before it launches on the infected device. Persistence is established through systemd, SysV init, shell profiles, and rc.local, while a cron job attempts to re-download the payload every five minutes.
Modules and Features
The malware's modules include an interactive shell that gives operators direct control over compromised systems, file-transfer commands that support uploads and downloads, a credential sniffer module that monitors ‘/proc/net/tcp’ and attempts to capture HTTP Basic Authentication and Cookie headers, and a SOCKS5 module that supports direct listening and reverse-relay modes. The SSH scanner module uses 150 username and password combinations for enterprise-oriented accounts and performs post-login checks to avoid honeypots. Finally, the DDoS module that was inherited by Mirai supports 16 flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and an HTTP flood with customizable requests.
Defense and Prevention
To defend against botnet malware, keep your IoT devices’ firmware updated, replace default admin credentials, turn off remote access panels, and replace devices when the vendor no longer provides support for them. Once attackers have valid credentials, only 37% of their actions are blocked. Overall prevention scores can hide what happens after initial access.
Key points
- Evooo1Bot is a Mirai-based modular Linux botnet malware that targets internet-facing gateway devices.
- The malware's capabilities extend beyond turning devices into proxy nodes and include credential theft, SSH brute-forcing, and launching DDoS attacks.
- Evooo1Bot has been targeting devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link across various regions.
- The malware uses encrypted C2 communications over port 443 and performs extensive checks for debuggers and security tools.
- Evooo1Bot has a credential sniffer module that monitors ‘/proc/net/tcp’ and attempts to capture HTTP Basic Authentication and Cookie headers.
If this development plays out positively, it could lead to better security measures being implemented to prevent botnet malware from taking over internet-facing devices. This could include more frequent firmware updates, improved password security, and better monitoring of remote access panels.
The realistic downside risks or failure modes of this development include the potential for Evooo1Bot to spread further and compromise more devices, leading to increased DDoS attacks and credential theft. Additionally, the malware's ability to evade detection and persistence mechanisms could make it difficult to remove once it has taken hold.
