News Summary

• Researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot.
• It derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies.
• Evidence indicates that the botnet has been active in the wild since July 2026, exploiting known vulnerabilities in publicly-accessible devices to deliver the malware.
• The CVE attack module includes the ability to launch exploits for eight security flaws impacting Hikvision, Atlassian Confluence, Zyxel, TP-Link, D-Link and Kubernetes.