New Evooo1Bot Botnet Turns Routers Into Secret Traffic Relays

Emily Davis · 2026-08-15

You might think your router is just a boring box that sits in the corner and keeps your Wi-Fi working. But to cybercriminals, that same device is a perfect hiding spot for their dirty work. A newly discovered Linux botnet called Evooo1Bot is doing exactly that, turning internet-facing routers and gateway devices into SOCKS5 traffic relay nodes without their owners knowing a thing. This isn't some amateur script-kid operation. Evooo1Bot is built on the infamous Mirai codebase, which has a long history of hijacking poorly secured devices. What makes this one different is its modular design. Instead of just launching DDoS attacks like the original Mirai, this botnet quietly repurposes your hardware to bounce malicious traffic through your home or office network. ### What Does SOCKS5 Relay Mean for You? In plain English, a SOCKS5 relay lets someone route their internet traffic through another device. When your router becomes a relay, attackers can send spam, launch attacks, or hide their identities using your IP address. Your device becomes a pawn in their game, and you might never see it coming. - Your internet speeds could drop noticeably - Your IP address could get flagged by banks or streaming services - You could be held liable for illegal activity traced back to your connection - Your network becomes slower and less secure overall The scary part? Most routers don't have any built-in alert system. You won't get a notification saying your device has been compromised. The botnet works silently in the background, and many victims only find out after law enforcement knocks on their door or their ISP suspends their account. ### How Does Evooo1Bot Get In? Like most Mirai variants, Evooo1Bot hunts for devices with weak credentials. It scans the internet for routers and gateways that still use default usernames and passwords like "admin" and "admin" or "root" and "1234." If your router hasn't been updated in years, it's an even easier target. Once inside, the malware doesn't waste time. It immediately connects to a command-and-control server, downloads additional modules, and starts performing reconnaissance on your network. The modular nature means attackers can push new features later, turning your router into something far more dangerous than a simple relay. ### How to Protect Yourself Right Now The good news is that protecting your network from Evooo1Bot doesn't require advanced technical skills. Simple steps go a long way, and you can do most of them in under ten minutes. - Change your router's default admin password to something long and unique - Disable remote management unless you absolutely need it - Update your router's firmware to the latest version - Turn off unused services like Telnet and UPnP - Consider replacing older routers that no longer receive security patches ### What This Means for the Future of Botnets Evooo1Bot is a wake-up call. The threat landscape is shifting from simple DDoS machines to multi-purpose crimeware that can adapt and evolve. Your router is no longer just a networking device; it's a potential weapon in someone else's arsenal. Security researchers are tracking this botnet closely, but the reality is that new variants appear all the time. The best defense is still a proactive one. If you manage a network for a small business or an office, take these threats seriously. A compromised router can expose sensitive data and ruin your reputation. Stay vigilant, change those default passwords, and remember that the devices you trust the most are often the ones attackers target first.