Evooo1Bot turns exposed routers into monetized SOCKS5 traffic relays

Early July 2026. Fortinet researchers spot the first infections of a new piece of malware. August 15, 2026. The lab publishes its analysis of Evooo1Bot, a modular Linux botnet derived from Mirai. In between. Thousands of routers and gateways left exposed on the internet were quietly turned into SOCKS5 traffic relays.

The headline is not the DDoS — Mirai has done that since 2016. It is the botnet’s economic goal: reselling the bandwidth and IP address of legitimate routers as if they were a residential proxy rented on demand.

A Mirai descendant that learned to hide

Evooo1Bot reuses the DDoS engine from the publicly leaked Mirai source code, but pushes far beyond raw flooding: encrypted C2 over port 443, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and a bundled exploit arsenal. It ships as twelve distinct builds, one per CPU architecture — x86, ARM, MIPS — and clears the Bash history after install to scrub its tracks.

Stealth is a design requirement. Before running, the malware checks for debuggers, security tools, virtual machines, containers, and honeypots. Persistence leans on systemd, SysV init, shell profiles, and rc.local, plus a cron job that re-downloads the payload every five minutes. An infected box is locked down twice over.

Mirai is ten years old, and its descendants never stopped mutating

To place Evooo1Bot in its lineage, go back to September 2016, when the Mirai source code was published. Three weeks later, the botnet hit Dyn, the DNS provider, with a then-record DDoS of roughly 1.2 Tbps, knocking services like Twitter, Spotify, and GitHub offline across the US East Coast. The leaked code has been reused, patched, and extended ever since: each new family adds a module, a vector, a persistence trick.

Evooo1Bot follows that exact arc. It inherits Mirai’s DDoS engine, but its value is not in the floods — it is in what the 2016 code could not do: encrypted C2, credential sniffing, and above all the SOCKS5 relay. The recent Dysphoria family, reported across more than 200,000 devices, and Evooo1Bot point the same way: the router botnet is no longer a weapon of destruction, it is rental infrastructure.

The SOCKS5 relay, the real economic novelty

The most instructive module is the SOCKS5 relay. It runs in direct-listening or reverse-relay mode and opens several sessions at once. In practice, an attacker’s traffic — or a paying customer’s — exits through your router, carrying your residential IP address, on its way to its final destination.

That is exactly how commercial residential proxy services work: they rent millions of home IP addresses to dodge geoblocks, rate limits, and blacklists. Fortinet notes that if the botnet grows large enough, operators can monetize the capacity directly. Your router becomes an anonymous exit node for other people’s traffic — aggressive scraping, credential stuffing, fraud — while your ISP sees nothing but your own usage.

The credential sniffer makes it worse: it watches /proc/net/tcp and harvests HTTP Basic Authentication headers and cookies passing through the device. The SSH scanner tries 150 combinations of enterprise-oriented credentials against neighboring hosts, with post-login checks built to avoid honeypots.

Who is targeted, and how it spreads

Fortinet lists the vendors hit since July: Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link. The common thread is not the vendor but the configuration: gateways reachable from the internet, often end-of-life or still running default credentials.

Newer builds add a separate exploitation module that widens the target set: Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installs. Fortinet cautions that some embedded exploits are badly implemented and fail — a reminder that botnets often ship sloppy code without that denting their overall impact.

The chain is simple: a working exploit downloads one of the twelve builds matching the host architecture, then the infection installs and hides. The Mirai-derived DDoS module remains available on the side, with sixteen flood methods — UDP, DNS, SYN, ACK, GRE, fragmented TCP, and a customizable HTTP flood.

What an exposed router actually risks

The consequences play out on three levels. Technical first: an enlisted gateway loses bandwidth, gains latency, and runs its CPU hot. Legal second: if the relay serves fraud or attacks, it is your IP address in the victim’s logs, and you are the one who must prove you were not the author. Security third: the sniffer and SSH scanner turn the router into a pivot into the rest of your LAN — the malware does not need to go further to become a major problem.

The sneakiest scenario is the dormant relay: a router turned proxy can run for weeks with no visible symptom while its capacity is rented out. That is precisely what makes passive detection hard and prevention decisive.

For home and small-business users, the same logic applies at a smaller scale: a single misconfigured router is enough to launder someone else’s traffic through your connection, and the first sign is often a letter from your ISP — or a knock from a victim’s lawyers.

How to tell if your router is already enlisted

Detecting a compromised router is asymmetric: the malware is built to stay quiet, but it leaves measurable traces. The signals to watch are concrete:

• Abnormal outbound traffic: SOCKS5 or HTTPS connections to unusual destinations, especially on port 443 toward hosts with no relation to your usage.
• Suspicious scheduled jobs: a cron entry re-downloading a binary every few minutes is the exact fingerprint of Evooo1Bot.
• CPU and memory load: a router working while nobody is using it deserves a look.
• Network behavior: a gateway that starts SSH-scanning its neighbors is no longer neutral.

When in doubt, the most reliable answer is not to “clean”: it is to factory-reset the device, reflash the firmware from an official source, then reconfigure with fresh credentials. A router that has been compromised cannot be half-repaired — it gets reflashed or replaced.

Verdict

If you run a fleet of routers or gateways, start with an inventory: which devices are reachable from the internet, and which have dropped out of vendor support. For every exposed device, apply three measures in order: update the firmware, replace default credentials, and disable remote (WAN) administration in favor of access over VPN. An end-of-life device must be replaced, not just isolated.

If you defend an enterprise network, watch for the fingerprints of this botnet family: outbound SOCKS5 to unusual destinations on port 443, cron jobs re-downloading binaries, and repeated SSH attempts toward internal hosts originating from an edge device. A router that starts SSH-scanning its neighbors is no longer your router.

The deeper signal is that the line between opportunistic malware and commercial infrastructure is dissolving: Evooo1Bot is one link in a chain where residential bandwidth trades like a commodity. Your router is the easiest asset on your network to lose — and the most profitable one to steal.

References

• BleepingComputer — New Evooo1Bot Linux botnet turns routers into traffic relay nodes, August 15, 2026
• Fortinet — Evooo1Bot: analysis of a modular Mirai-based Linux botnet (report cited by BleepingComputer), accessed August 16, 2026