A newly identified Linux botnet dubbed Evooo1Bot is targeting vulnerable internet-facing routers, edge appliances, cameras, and enterprise systems, combining Mirai-derived DDoS capabilities with proxy relaying, credential theft, SSH brute forcing, and exploit-driven propagation. FortiGuard Labs observed activity beginning in July 2026, with operators using a modular toolset that elevates compromised devices from disposable DDoS nodes […]

The post Evooo1Bot Turns Compromised Routers Into DDoS Bots and Anonymous Proxy Nodes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Botnet operators are systematically probing router diagnostic interfaces for OS command injection flaws, chaining default credentials, legacy CGI endpoints, and weak command execution patterns to gain full remote control and deploy Mirai‑like payloads. Recent scan telemetry shows concentrated HTTP requests targeting a tight set of “diagnostic” URLs on internet‑exposed routers, including /apply.cgi, /cgi-bin/diagnostic.cgi, /cgi-bin/adv_ping.cgi, /DiagnosticsMsg.cgi, […]

The post Botnet Scans Router Diagnostic Tools for OS Command Injection Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A covert Monero (XMR) cryptomining campaign uncovered in May 2026 is abusing Linux Pluggable Authentication Modules (PAM) to evade detection, maintain fileless execution, and persist across multiple user accounts on compromised hosts. The operation, tracked as part of the V25 (Generation 26) campaign family, demonstrates a mature blend of supply chain abuse, PAM weaponization, and […]

The post Linux XMRig Botnet Abuses PAM for Fileless Monero Mining and Persistent Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.