This Linux Botnet Is Quietly Turning Routers Into Spying Tools

Robert Moore · 2026-08-15

You probably think of your router as that boring box in the corner that just makes your Wi-Fi work. But what if it was secretly working for someone else? That's the reality behind a newly discovered threat called Evooo1Bot, and it's a lot more clever—and scary—than your average malware. Security researchers have spotted this new Mirai-based botnet targeting internet-facing gateway devices. In plain English? It's finding routers and similar hardware that are exposed to the open internet, breaking in, and turning them into what are called SOCKS5 traffic relay nodes. ### What Does a SOCKS5 Relay Node Actually Do? Think of it like this: you're at a party, and someone asks you to pass a note to a stranger across the room. You don't know what's in it, and you don't care. You're just the middleman. That's essentially what a compromised router becomes. A SOCKS5 relay takes internet traffic from one place and sends it somewhere else. The bad guys use your router to bounce their activity through, which hides their true location. It's a classic anonymity trick, and your hardware is the unwilling pawn. ### Why Your Router Is a Prime Target Routers are perfect targets for a few simple reasons. First, they're always on. You don't shut your router down at night like you do your laptop. Second, they often run for years without any security updates. The firmware gets stale, and vulnerabilities stay open. Third, most people never check their router's admin logs. There's no antivirus pop-up telling you something's wrong. Here's what makes Evooo1Bot particularly nasty: it's modular. That means it's not just one fixed piece of code. The attackers can swap in different modules depending on what they want to do. Right now, it's focused on making your router a relay. Tomorrow, it could be used for something else entirely. ### The Mirai Connection If you've been around the cybersecurity world for a while, the name Mirai might ring a bell. It's the infamous botnet that took down huge chunks of the internet back in 2016. Evooo1Bot is built on that same foundation, which means it inherits some of that nasty, proven DNA. The authors took an old recipe and added new ingredients. ### How to Protect Yourself Right Now You don't need to be a security expert to make your router a harder target. Here are a few practical steps you can take today: - **Change the default admin password.** This is the single most important thing you can do. If your password is still "admin" or "password," you're practically inviting hackers in. - **Disable remote management.** Most home routers don't need to be accessible from the internet. Turn that feature off unless you absolutely need it. - **Update your firmware.** Check your router manufacturer's website or the admin panel for updates. It's a pain, but it's worth it. - **Reboot your router periodically.** It's not a cure-all, but it can clear out simple infections and force the device to re-establish its connection. ### The Bigger Picture This isn't just about your home Wi-Fi. Attackers are building massive networks of compromised devices. Each one is a small piece of a much larger puzzle. They use these networks to launch attacks, hide their tracks, and even sell access to other criminals. Your router is just a tool to them, and they don't care if it burns out. The scary part is that you might never know your router is compromised. There's no obvious sign, no flashing light that says "I'm a bot." The traffic just flows through, silently and constantly. That's why being proactive matters. A few minutes of your time now could save you from being part of a problem you never even knew existed.