VulnHub

Researchers have discovered a new Linux botnet called Evooo1Bot, which builds upon the Mirai botnet's source code. This botnet can exploit known vulnerabilities to convert internet-facing devices into SOCKS5 proxies. The malware not only incorporates the DDoS capabilities of Mirai but also adds several new features that enhance its functionality. This poses a significant risk as it can affect various edge devices that are often less secure and can be used for malicious activities like distributed denial-of-service attacks. Users and companies with exposed devices need to take immediate action to protect their systems from this emerging threat.

A new botnet named Evooo1Bot has emerged, targeting internet-facing routers and other gateway devices. Based on the Mirai malware, this botnet converts these devices into SOCKS5 traffic relay nodes, allowing attackers to route internet traffic through them. This can enable various types of malicious activities, including distributed denial-of-service (DDoS) attacks. The attack affects any vulnerable Linux-based routers or similar devices that are exposed to the internet, making it crucial for users and network administrators to secure their devices against unauthorized access. As the botnet continues to spread, it poses a significant risk to network integrity and privacy.

A new botnet called Evooo1Bot has emerged, built on the Mirai framework and featuring enhanced capabilities. This botnet is designed to convert compromised edge devices into persistent proxies, which can be exploited for various malicious activities. Researchers have noted that this could significantly impact Internet of Things (IoT) devices, making them potential tools for cybercriminals. The ability to create proxies means that attackers can mask their identity and amplify their operations, raising concerns about privacy and security. Users of affected devices need to be vigilant and improve their security measures to prevent being turned into unwitting participants in these attacks.

Hitachi Energy has reported vulnerabilities affecting its APM Edge product, specifically versions 6.10 and earlier. These vulnerabilities, identified as CVE-2026-43284 and CVE-2026-43500, could allow local unprivileged users to escalate their privileges to root. The flaws stem from issues in the Linux kernel's handling of network packets, which could lead to unauthorized access to critical system binaries. This poses significant risks to the confidentiality, integrity, and availability of the affected systems, particularly in the energy sector where APM Edge is deployed globally. Users are advised to disable certain kernel modules to mitigate these risks while further remediation steps are being evaluated.

Researchers have discovered a new attack method called the TONTOU CPU attack, which can bypass the recent fixes for the Spectre v2 vulnerabilities. This exploit allows attackers to leak sensitive information, including password hashes from Linux systems. The implications are significant, as many users and organizations rely on Linux for their operations, and this vulnerability can compromise the security of their systems. Users and administrators are urged to be vigilant and consider implementing additional security measures to protect against potential exploitation. The findings emphasize the ongoing challenges in securing speculative execution vulnerabilities in modern processors.

A newly discovered vulnerability in the Linux kernel's Open vSwitch datapath allows local users to gain root access on several default-configured distributions. This memory corruption flaw, identified as CVE-2026-64531 and given the codename OVSwrap, has a CVSS score of 7.8, indicating a high severity. Security researcher Asim disclosed this issue, which comes with a public exploit that has pre-built records for about 800 different kernel builds. This broad impact means that many users could be affected if they have systems running these vulnerable kernel versions. Companies and system administrators should take immediate action to assess their environments and apply necessary patches to mitigate this risk.

The Arch Linux project has temporarily halted the adoption of packages from the Arch User Repository (AUR) due to a significant rise in malicious takeovers of existing packages. This decision comes after several reports indicated that attackers were compromising accounts of trusted maintainers and injecting malware into popular packages. The move affects users who rely on AUR for software installation and updates, as they will no longer be able to adopt new packages during this period. The Arch Linux team is working to address the issue and enhance security measures to protect its community from further incidents. Users are advised to remain vigilant and report any suspicious activity related to AUR packages.

A cryptomining group has been using a clever tactic to avoid detection by security operations center (SOC) analysts. Instead of maintaining root access, which is easily flagged, they are impersonating low-privileged Linux users. This method allows them to operate under the radar while still mining cryptocurrency. The implications of this behavior are significant, as it complicates the ability of organizations to detect and respond to such illicit activities. Security teams need to be aware of these tactics to better protect their systems from unauthorized cryptomining operations.

Toptech Systems has reported a serious vulnerability in its RCU II+ and Multiload II+ products, which could allow attackers to gain unauthorized control over these devices. The flaw, identified as CVE-2026-12562, affects all versions of RCU II+ and Multiload II+ released before November 24, 2025. This vulnerability stems from a debug interface that lacks authentication, enabling attackers to access the system's Linux environment directly. If exploited, this could lead to significant manipulation of connected networks and resources. Users are urged to take defensive measures, including isolating the devices from untrusted networks and applying available vulnerability removal tools or firmware updates to protect against potential exploitation.

Kaspersky researchers have identified a new strain of ransomware called GenieLocker, which targets Windows, Linux, and ESXi systems. This ransomware is associated with a group known as Toy Ghouls, which is primarily focused on financial extortion. The emergence of GenieLocker is concerning because it indicates a growing trend of customized ransomware that can impact multiple operating systems, making it a versatile threat for various organizations. Companies using affected systems should be vigilant and implement strong security measures to protect their data. With ransomware incidents on the rise, understanding the capabilities of threats like GenieLocker is crucial for effective defense strategies.

A new botnet called Tengu, derived from the well-known Mirai botnet, has been identified targeting compromised Linux devices. Researchers from Nozomi Networks Labs found that Tengu can utilize a device's hardware watchdog feature to reboot itself whenever defenders attempt to terminate its main process. This persistence method allows Tengu to re-establish its operation even after being interrupted. The botnet primarily gains access through brute-force attacks on Telnet credentials. Tengu is capable of launching distributed denial-of-service (DDoS) attacks, which can overwhelm targeted systems and disrupt online services. This incident raises concerns for organizations relying on Linux devices, as Tengu's ability to persist poses a significant challenge for cybersecurity defenses.