This New Botnet Turns Your Router Into a Proxy for Criminals

Emily Davis · 2026-08-17

Cybersecurity researchers just uncovered a nasty new piece of malware, and it's a reminder that the devices we rely on every day can be turned against us. Meet Evooo1Bot, a Linux botnet that's built on the infamous Mirai source code but goes far beyond the usual DDoS attacks. Its real trick? It silently converts internet-facing devices like routers, cameras, and other edge gadgets into SOCKS5 proxies for cybercriminals. That's right—your humble router, the one sitting in your living room or office, could be hijacked and used as a relay station for malicious traffic. And you'd probably never even know it. Let's break down what makes Evooo1Bot so dangerous and what it means for anyone managing a network. ### The Mirai Connection: A Familiar Foundation If you've been in the IT or cybersecurity world for a while, you've heard of Mirai. Back in 2016, this botnet made headlines by taking down major websites with massive distributed denial-of-service (DDoS) attacks. The source code was eventually leaked online, which was a gift that kept on giving—but not in a good way. Since then, countless cybercriminals have repurposed that code to build their own botnets. Evooo1Bot is the latest in that long line. It reuses the DDoS engine from Mirai, so it can still flood a target with traffic and knock it offline. But here's where it gets interesting: the authors didn't stop there. They extended the original framework with a bunch of new capabilities, and the focus seems to be on turning compromised devices into something far more stealthy and profitable. ### What Makes Evooo1Bot Different? While DDoS attacks are disruptive, they're not exactly subtle. They draw attention. The smart move for botnet operators is to use compromised devices for quieter, longer-term gains. That's where the SOCKS5 proxy functionality comes in. By turning your router into a proxy, attackers can route their traffic through your IP address, masking their true location and making it harder for law enforcement or security teams to trace them. Here's what that means in practice: - **Anonymity for criminals:** They can launch attacks, commit fraud, or access restricted content while hiding behind your IP. - **Bypassing geo-restrictions:** Your device becomes a gateway to different regions, which is valuable for ad fraud or credential stuffing. - **Stealthy persistence:** Unlike a loud DDoS attack, a proxy botnet can operate quietly for months without being noticed. This isn't just a theory. Researchers have seen a rise in botnets that prioritize proxy capabilities over raw DDoS power. The economics make sense—proxies are a commodity, and botnet operators can rent out access to compromised devices on the dark web. ### How Are Devices Getting Infected? The report highlights that Evooo1Bot exploits known flaws in internet-facing devices. That's a critical detail. It's not using some mysterious zero-day vulnerability; it's going after weaknesses that have already been disclosed. Many devices, especially older routers and IoT gadgets, never get patched. The vendor might have stopped supporting them, or the owner simply doesn't know how to update the firmware. This is a classic case of low-hanging fruit. Attackers scan the internet for devices running outdated software, and when they find one, they pounce. The Mirai-based code gives them a proven way to brute-force credentials or exploit specific vulnerabilities to gain access. ### What Can You Do About It? If you're responsible for any network—even a home one—there are steps you can take to reduce your risk. It's not about being paranoid; it's about being practical. - **Update your firmware:** This is the single most important step. Check your router's admin panel or the manufacturer's website for updates. Set a reminder to check every few months. - **Change default passwords:** If your device still uses "admin/admin" or "root/password," you're practically inviting attackers in. Use a strong, unique password. - **Disable remote management:** Unless you absolutely need it, turn off features that allow access to the device from the internet. This cuts off a common attack vector. - **Monitor your network traffic:** Keep an eye out for unusual activity. If your router is suddenly sending or receiving massive amounts of data, that's a red flag. ### The Bigger Picture Evooo1Bot is just one example of a growing trend. As more devices connect to the internet, the attack surface expands. The Mirai source code gave a generation of malware authors a head start, and they're not slowing down. The best defense is still vigilance and basic hygiene. So, take a few minutes today to check your router. It might not be glamorous, but it could save you from becoming an unwitting accomplice in cybercrime. And if you're managing devices for a business, make sure your IT team has a patch management process in place. Because the next botnet is already being built—and it's counting on you to leave the door open.