CVE-2007-3010 et al.: Evooo1Bot Linux Botnet — Remote Takeover, DDoS, Credential Theft (June 2024)

CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, CVE-2025-10123, CVE-2025-55583 — Evooo1Bot Linux Botnet

A new Mirai-variant botnet, Evooo1Bot, is actively exploiting at least ten critical CVEs—including CVE-2007-3010 and CVE-2016-6277—to achieve remote code execution and persistent control over Linux-based edge devices. These vulnerabilities, many with CVSS scores above 8.0, are being leveraged in the wild for DDoS, proxy relay, SSH brute force, and credential theft. Exploitation is confirmed and ongoing.

Attack Vector

Attackers deploy Evooo1Bot by scanning for Linux edge devices vulnerable to any of the listed CVEs. Initial compromise is achieved via remote code execution, often using the loader script wget.sh hosted at 91.92.40.118. The malware identifies itself with the hardcoded string evooo1 and communicates with its C2 server over port 443. Once installed, Evooo1Bot uses modular payloads for DDoS, SOCKS proxy relay, and credential harvesting, and implements persistence to survive reboots.

Who Is at Risk

All organizations operating Linux-based edge devices—such as routers, gateways, and IoT appliances—running unpatched firmware vulnerable to the listed CVEs are at risk. The threat is global and spans multiple industries. No vendor-specific targeting has been observed; opportunistic scanning is the primary method.

Patch & Mitigate

• Patch: Apply vendor security updates for all affected CVEs immediately. Prioritize patching of internet-exposed Linux edge devices. No single hotfix covers all CVEs; consult vendor advisories for each.
• Workaround: Restrict remote access to management interfaces. Disable unused services and enforce strong authentication.
• Detect: Monitor for outbound connections to 91.92.40.118 and anomalous traffic on port 443. Search for execution of wget.sh and the presence of the evooo1 string in running processes or binaries.

MITRE ATT&CK

• TA0001 — Initial Access: Exploitation of public-facing applications enables remote compromise.
• TA0011 — Command and Control: Persistent C2 traffic over port 443 to attacker infrastructure.
• TA0007 — Discovery: The botnet scans for additional vulnerable devices and network resources.

Source: https://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot