A new Linux botnet named Evooo1Bot is turning internet-facing routers and other gateway devices into SOCKS5 traffic relay nodes, giving attackers a way to route malicious connections through compromised systems while retaining the ability to steal credentials, brute-force SSH accounts, exploit vulnerable devices and launch DDoS attacks.
FortiGuard Labs said it has been tracking the Mirai-based malware since at least July 2026, with activity observed against devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link across multiple regions. Rather than relying on a single attack function, Evooo1Bot combines several capabilities within a modular Linux malware framework.
The malware retains the DDoS engine from the publicly leaked Mirai source code, but expands on the older botnet's approach with encrypted command-and-control communications, an SSH brute-force scanner, a SOCKS5 relay, a credential sniffer and an exploitation module targeting known vulnerabilities.
Mirai's original success was closely tied to internet-connected devices such as routers, cameras and DVRs, many of which were exposed with weak or default credentials. Fortinet previously documented how Mirai could scan for vulnerable systems, brute-force credentials and recruit them into a remotely controlled botnet.
Evooo1Bot takes that model further by adding more ways to use a compromised device after the initial infection.
Its exploit arsenal covers a wide range of internet-facing technologies. Newer builds have been found with modules targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx and vulnerable PHP-CGI installations. FortiGuard noted, however, that some of the embedded exploits are incorrectly implemented and fail to compromise their intended targets.
When exploitation succeeds, the malware downloads a build suited to the victim's CPU architecture. FortiGuard identified 12 available builds, allowing the operators to target different Linux-based hardware rather than relying on a single binary.
The malware then attempts to make the compromise harder to trace. It clears Bash history and establishes persistence through mechanisms including systemd, SysV init, shell profiles and "rc.local". A cron job also attempts to download the payload again every five minutes, providing another way to restore the malware if it is removed.
Evooo1Bot also checks its surroundings before fully activating. It searches for debuggers, security software, sandboxes, virtual machines, containers and honeypots, indicating that the operators are attempting to distinguish ordinary victims from environments where the malware could be analyzed.
Its encrypted C2 communications operate over port 443, while an interactive shell gives operators direct control over infected systems. The malware also supports file uploads and downloads and uses a 28-command interface for remote operations.
The SOCKS5 component is where Evooo1Bot moves beyond the conventional DDoS-botnet model.
A SOCKS5 proxy can relay network connections through another system. In this case, the infected router becomes the intermediary, allowing attackers to send traffic through the victim's connection. Evooo1Bot supports both direct-listening and reverse-relay modes, which could help operators conceal the origin of malicious traffic, bypass geographic restrictions or reach networks accessible through compromised devices.
Multiple proxy sessions can operate independently, raising another possibility if the botnet expands: monetizing compromised residential connections as proxy infrastructure.
The malware also monitors "/proc/net/tcp" for network activity and attempts to capture HTTP Basic Authentication and Cookie headers. Alongside its shell and file-transfer functions, this gives operators additional opportunities to obtain information from systems positioned behind the compromised gateway.
SSH provides another route into vulnerable systems. Evooo1Bot uses 150 username and password combinations aimed at enterprise-oriented accounts and performs checks after successful authentication to identify possible honeypots.
DDoS remains part of the malware's toolkit, with 16 flood methods inherited from Mirai, including UDP, DNS, SYN, ACK, GRE, fragmented TCP and customizable HTTP floods.
The result is a botnet in which a compromised router can serve several purposes at once: it can participate in DDoS attacks, relay traffic, collect authentication material, provide remote shell access and help operators compromise additional vulnerable systems.
For users and organizations, securing these devices starts with applying firmware and security updates, replacing default administrator credentials and disabling unnecessary remote-access interfaces. Unsupported equipment that no longer receives security updates should also be replaced.
Network defenders should additionally watch for unexpected outbound connections, unusual proxy traffic and unauthorized changes to cron jobs, startup services or shell profiles.
Evooo1Bot shows why internet-facing routers and gateways cannot be treated simply as passive networking equipment. Once compromised, they can become operational infrastructure for an attacker, extending the intrusion far beyond the device itself.
