{
  "id": 1403724,
  "title": "Evooo1Bot: A Multi-Functional Linux Botnet That Turns Compromised Gateways into SOCKS5 Relays, SSH Spreaders, and DDoS Tools",
  "url": "https://urgent.news/2026/08/17/evooo1bot-a-multi-functional-linux-botnet-that-turns-compromised",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-17T02:42:51.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anoymask/evooo1bot-a-multi-functional-linux-botnet-that-turns-compromised-gateways-into-socks5-relays-ssh-27kg"
  },
  "original_language": "en",
  "account": null,
  "summary": "The Evooo1Bot is a multi-functional Linux botnet that utilizes publicly exposed devices with known vulnerabilities and various credential combinations to infect and compromise Linux gateways. Once compromised, the botnet can deploy payloads that support 12 CPU architectures, utilizing encrypted C2 communications, SOCKS5 relaying, credential sniffing, SSH spreading, persistence, and 16 types of DDoS attacks. The attack flow chain consists of four stages: exploiting publicly exposed devices, evading analysis and establishing C2, spreading via SSH credential attacks, and post-compromise relaying, persistence, and attacks.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}