Evooo1Bot: A New Twist on an Old Threat

Security researchers have spotted a fresh Linux botnet that borrows its core from the infamous Mirai malware — but adds some serious upgrades. Dubbed Evooo1Bot by Fortinet’s FortiGuard Labs, this modular threat is actively exploiting a wide range of vulnerabilities in routers and edge devices. The goal? Not just DDoS attacks, but turning victims into covert proxies.

The botnet gets its name from the hardcoded string “evooo1” found in every binary. Analyst Yi Ping (Cara) Lin published the technical breakdown on August 13, after observing a string of exploit attempts tied to a single loader URL: 91.92.40[.]118/wget.sh.

That URL was the common thread linking attacks against at least ten distinct CVEs, spanning vendors like Alcatel, NETGEAR, Tenda, D-Link, and Mitsubishi Electric.

Targets: Old and New Vulnerabilities

Evooo1Bot isn’t picky. It goes after legacy flaws that have been public for years, alongside more recent disclosures. Some of the key CVEs in its arsenal:

• CVE-2007-3010 — Alcatel OmniPCX Enterprise RCE
• CVE-2016-6277 — NETGEAR multiple routers RCE
• CVE-2018-14558 — Tenda AC7, AC9, AC10 command injection
• CVE-2020-10987 — Tenda AC15 RCE
• CVE-2021-46422 — Telesquare SDT-CW3B1 command injection
• CVE-2022-37055 — D-Link routers buffer overflow
• CVE-2024-29269 — Telesquare TLR-2005KSH command injection
• CVE-2025-10123 — D-Link DIR-823X command injection
• CVE-2025-55583 — D-Link DIR-868L B1 command injection

That mix of old and new is a deliberate strategy. Many of these devices are end-of-life, meaning vendors won’t patch them. And plenty of still-supported gear never gets updated by users anyway.

More Than Just DDoS

Mirai’s original claim to fame was massive distributed denial-of-service attacks, powered by armies of compromised IoT cameras and routers. The source code leaked in September 2016, after creator Paras Jha and his co-conspirators released it to muddy the waters as the FBI closed in. That leak spawned a thousand copycats.

Evooo1Bot follows that lineage, but it’s not content to just flood targets with traffic. The malware includes a 28-command remote administration interface, encrypted C2 communications, and an SSH brute-force scanner. It also packs a credential sniffer and multiple layers of obfuscation using AES-256-CTR, ChaCha20, and XOR-based key derivation.

What really sets it apart, according to Lin, is the reverse SOCKS relay module. That feature turns a compromised device into a persistent proxy. An attacker can route traffic through the victim’s machine, hiding their true origin and pivoting deeper into internal networks.

“These capabilities place Evooo1Bot well beyond the technical baseline of conventional Mirai-derived malware,” Lin wrote in her analysis.

How the Proxy Relay Works

The SOCKS relay is arguably the most operationally significant part of the botnet. Here’s why it matters:

• Anonymity — Attackers route traffic through victim devices, making attribution much harder.
• Pivoting — Once inside a network, they can move laterally to other systems.
• Follow-on operations — The same proxy can be used for credential theft, data exfiltration, or further exploitation.

In other words, your router could be someone else’s getaway car.

Who’s Being Targeted?

Lin’s analysis suggests Evooo1Bot has been actively scanning for internet-facing devices since at least July 2026. The campaign appears to span multiple regions, with no single geographic focus. Any organization with exposed routers, switches, or IoT gear is a potential victim.

That’s a wide net. Small offices, home users, industrial control networks — all rely on edge devices that are often forgotten once installed.

How to Protect Yourself

There’s no single silver bullet, but basic hygiene goes a long way:

• Patch everything — Apply firmware updates as soon as they’re available. For end-of-life devices, replace them.
• Change default credentials — Mirai’s original trick was guessing weak passwords. Don’t give it a chance.
• Disable remote management — If you don’t need admin access from the internet, turn it off.
• Segment your network — Keep IoT devices on a separate VLAN so a compromise doesn’t spread.
• Monitor for anomalies — Unexpected outbound connections from routers or cameras are a red flag.

For more on how these attacks unfold, check out our guide on Mirai botnet variants and IoT security. And if you’re wondering about the broader threat landscape, read about router vulnerabilities and how to fix them.

The Bottom Line

Evooo1Bot is a reminder that old code never dies — it just gets repurposed. Mirai’s leaked source has fueled a decade of malware, and this latest variant shows how far the genre has evolved. The DDoS engine is still there, but the proxy relay and encryption make it a far more dangerous tool.

If you have internet-facing devices, assume they’re being scanned right now. Patch what you can, replace what you can’t, and don’t rely on default settings to keep you safe.

Stay ahead of the threat. Learn more about botnet protection strategies to keep your network clean.

ExfilSquad’s Claims Check Out

New research from Fortra’s Intelligence and Research Experts (FIRE) has confirmed that the ExfilSquad data extortion group really did get its hands on sensitive data. The criminals claimed they had exfiltrated information from 15 organizations. Now, the evidence shows they weren’t bluffing.

FIRE reviewed the public data samples and concluded that the group’s access to sensitive data is real. At least 13 victims have been hit, spanning government, education, financial services, and manufacturing. That’s not a small-time operation.

The group first surfaced on July 26. By August 7, they had published data dumps for 13 of the 15 claimed victims via torrents, saying those organizations didn’t meet their demands. The full archive, named “[victim]_exfilsquad,” was up for download. The total haul? A staggering 382.64 GB and 27 million records.

Who Got Hit?

The victim list reads like a cross-section of public and private sectors. The City of Atlanta (atlantaga.gov), the UK Department for Education (education.gov.uk), and the UK Police National Legal Database all appear. The District of Columbia Public Schools (DCPS) is also on the list.

For DCPS, the attackers took an unusual stance. They wrote: “We are not going to dox a bunch of school children, but we are going to expose how incompetent DCPS is at keeping children as young as six’s information safe. Thus, we are releasing a censored version of the leak and have shredded the original entirely from our servers.”

In that case, 60,000 records were leaked, containing student names, dates of birth, and unique student identifiers—classic personally identifiable information (PII).

Notably, Zenith Bank Plc and Analog Devices were on the original 15-victim list but didn’t appear in the dumps. The FIRE team flagged this as a possible sign that those negotiations went differently, or the data wasn’t ready to be released.

The Likely Attack Vector: Misconfigured Microsoft Power Pages

So how did ExfilSquad pull this off? Fortra’s researchers believe the breaches stem from unauthorized access to Microsoft D365 CRM and ERP instances. The leading theory? Misconfigured Microsoft Power Page portals that allowed public read access.

Power Pages is a SaaS platform for building external-facing business websites. If set up wrong, it can expose data to anyone who knows where to look. The leaked data formations matched Microsoft Dataverse exports, which suggests unauthorized read access was achieved during the incidents.

The attackers probably found their targets by crawling for misconfigured Power Portals or using other enumeration techniques. It wasn’t a sophisticated zero-day exploit. It was a configuration error—and that’s what makes it so dangerous.

Why It’s Not a D365 Vulnerability

Fortra was quick to note that because the breach hit only 15 victims, not tens of thousands, a systemic vulnerability in D365 is unlikely. Instead, the issue is specific to how Power Pages is configured.

There’s a known problem: when the Anonymous Users web role is assigned to a table permission, anyone visiting the site can read the table’s data. Power Pages can be accessed via an API at https://<portal>/_api/*. Microsoft’s own documentation advises against using this role in publicly exposed sites, but not everyone follows the guidance.

Fortra’s research even found over 10,000 potential Power Pages instances accessible to the public. That’s a lot of attack surface.

What This Means for Organizations

This incident is a wake-up call. Data extortion groups like ExfilSquad are actively scanning for misconfigured systems. They don’t need to break in—they just need a door left open.

For any organization using Microsoft Power Pages or D365, the takeaway is clear: audit your table permissions, disable Anonymous Users roles on public sites, and monitor API access. A few minutes of configuration review could save you from a 382 GB leak.

If you’re dealing with a similar threat, understanding the data extortion group tactics can help you prepare. And if you’re using Microsoft Power Pages security settings, double-check them now.

The ExfilSquad data leak is a reminder that cybercriminals are patient and methodical. They find the weak spots, and they exploit them. Don’t be the next headline.

Two ransomware cases hit major milestones in U.S. courts

Federal prosecutors are closing in on the people who built and ran some of the most damaging ransomware operations of the past decade. This week brought two significant developments: a Ryuk operator pleaded guilty in Oregon, and a Florida man who helped the Blackcat/AlphV gang got a 70-month prison sentence.

Karen Serobovich Vardanyan, a 34-year-old Armenian national, admitted to conspiracy and computer fraud charges on Wednesday. For about six months starting in November 2019, he broke into corporate networks to deploy Ryuk ransomware, according to prosecutors.

Separately, Angelo Martino, 41, of Land O’Lakes, Florida, was sentenced to 70 months in federal prison for aiding Blackcat/AlphV extortion efforts beginning in April 2023. Martino’s case stands out because he used his day job as a ransomware negotiator to help the criminals squeeze more money out of victims.

Vardanyan’s Ryuk attacks: a Michigan company paid 200 bitcoin

Vardanyan was extradited from Ukraine to the U.S. in June 2025, after his arrest in Kyiv two months earlier. He now faces up to 15 years in prison and fines up to $500,000. He has also agreed to pay more than $1.1 million in restitution. His sentencing is set for September 22.

Prosecutors detailed some of his alleged attacks. “Vardanyan worked with his co-conspirators to attack a company in Michigan that paid 200 bitcoin or over $1.1 million at the time of payment to restore access to their network,” they said. “They also attacked a company in Wilsonville, Oregon, and in February 2020 attacked a school in Texas.”

Ryuk first appeared in August 2018, targeting large organizations with enormous ransom demands. Law enforcement and cybersecurity researchers have tied it to other major cybercrime operations, including Conti and Trickbot. International authorities have pursued Ryuk for years, successfully prosecuting one of its money launderers and sanctioning other alleged members.

Other Ryuk defendants still being pursued

Vardanyan’s case is part of a broader crackdown. Armenian national Levon Georgiyovych Avetisyan faces conspiracy, fraud, and extortion charges. Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko face the same charges. Prosecutors said last year that Avetisyan was in custody in France, while the two Ukrainians remained at large.

The U.S. Department of Justice has been steadily dismantling the Ryuk ecosystem, which also overlaps with the Trickbot botnet infrastructure. Each guilty plea and arrest chips away at the network’s ability to operate.

Martino: the negotiator who turned against his own clients

Martino surrendered to U.S. Marshals in March and pleaded guilty in April to an extortion charge. His story is a cautionary tale about trust in the cybersecurity industry.

Prosecutors said Martino “was paid by BlackCat attackers to provide confidential information about the negotiating position and strategy of his employer’s clients and enable the ransomware actors to maximize the ransoms paid by the victims.” In other words, he was double-dealing — collecting a salary from a legitimate firm while secretly working for the criminals on the other side of the negotiation table.

Two other men connected to the same case, Ryan Goldberg and Kevin Martin, pleaded guilty to extortion charges earlier this year. Both received four-year prison sentences in May. Martin and Martino were ransomware negotiators for DigitalMint, while Goldberg worked for incident response firm Sygnia.

DigitalMint has since implemented new controls requiring all negotiations to be conducted over cloud-based platforms that can be audited and logged. One of the company’s founders is personally overseeing all negotiations now.

What this means for ransomware enforcement

These cases show that law enforcement is willing to pursue not just the hackers who deploy ransomware, but also the people who enable them — even when those people hold legitimate jobs in the cybersecurity industry. The Martino case, in particular, sends a message to negotiators and incident responders: if you cross the line, you’ll face serious consequences.

For ransomware victims and negotiators, the takeaway is clear. Verify who you’re working with. Check backgrounds. And be aware that the person helping you negotiate could be feeding information to the attackers.

Both cases also highlight the international scope of ransomware investigations. Vardanyan was arrested in Ukraine and extradited to the U.S. Avetisyan is in French custody. The Justice Department is coordinating with allies to chase these suspects across borders.

Sentencing for Vardanyan is scheduled for September 22. Martino’s 70-month sentence is already in place. The fallout from these cases will likely continue as prosecutors pursue the remaining defendants.