Before the vulnerability record

Threat Activity

Track reported campaigns, active threat actors and targeted sectors, including activity described before a CVE is named.

Updated 20 Aug 2026 · 15:32 UTC

Evidence, not prediction.

Pre-CVE means a trusted source has described malicious activity or a previously unknown weakness without naming a CVE. ATT&CK mappings marked Explicit were stated by the source. Inferred mappings are conservative interpretations of source wording and must be verified against the original report.

5Reports in 24 hours

0Pre-CVE reports · 7 days

30Named actors · 30 days

7Targeted sectors · 30 days

2ATT&CK-mapped reports · 7 days

Emerging activity

1 of 1 reports shown

29Signal

THREAT REPORT

Multi-Functional Linux Botnet “Evooo1Bot”

FortiGuard Labs analyzes Evooo1Bot, a modular Linux botnet targeting internet-facing devices with DDoS, SSH attacks, CVE exploits, and SOCKS relays

Source: FortiGuard Labs Threat Research
Published: 13 Aug 2026 · 13:00 UTC
Actor: Not named
Targets: Not specified

MITRE ATT&CK

T1021Remote ServicesLateral Movement · Inferred · 68% confidence

Read source ↗

Provenance and freshness

Source coverage

The dashboard currently uses freely available government, vendor and vendor-research reporting. A source problem is shown here instead of silently hiding stale data.

HEALTHY

Threat Activity

Emerging activity

Multi-Functional Linux Botnet “Evooo1Bot”

Source coverage

UK NCSC

CERT-EU Threat Intelligence

Google Threat Intelligence Group

The DFIR Report

Cisco Talos Intelligence

Microsoft Security Blog

SentinelLABS

ESET Research

FortiGuard Labs Threat Research

Securelist

Check Point Research

Palo Alto Networks Unit 42