This Linux Botnet Is Quietly Turning Routers Into Proxy Servers

Michael Miller · 2026-08-15

You probably don't think about your router very often. It sits in the corner, blinking away, doing its job. But what if I told you that a new piece of malware is targeting these exact devices, turning them into something they were never meant to be? Security researchers have spotted a new Mirai-based modular Linux botnet called Evooo1Bot. And it's not just another DDoS tool. This one has a different goal: turning internet-facing gateway devices into SOCKS5 traffic relay nodes. In plain English, that means your router could be hijacked to route other people's traffic, hiding their activity behind your IP address. ### What Is Evooo1Bot Exactly? Evooo1Bot is a modular botnet, which means it's built with different components that can be swapped in and out depending on what the attacker wants to do. It's based on the infamous Mirai source code, which leaked years ago and has since spawned countless variants. But Evooo1Bot takes a different path than most. Instead of using infected devices for massive DDoS attacks, it focuses on turning them into SOCKS5 proxies. This is a big deal because it makes the botnet much harder to detect and takedown. The infected routers become anonymous relay points, and the attackers can use them for anything from credential stuffing to evading geo-restrictions. ### How Does It Get In? The malware is targeting internet-facing gateway devices, which is a fancy way of saying routers and modems that are directly exposed to the internet. It typically exploits weak credentials or known vulnerabilities in the device's firmware. If you've never changed the default admin password on your router, you're basically leaving the front door unlocked. Once it gets in, Evooo1Bot establishes persistence. It doesn't just run once and disappear. It sets itself up to survive reboots and even tries to hide its presence from common monitoring tools. The modular nature means it can also download additional payloads, making it a flexible tool for attackers. ### Why Should You Care? You might be thinking, "I don't have anything valuable on my router." And that's true, but it's not about what's on the router. It's about what your router can do. When your device becomes a relay node, it's using your bandwidth and your IP address. That means if someone uses your router to commit a crime online, the trail leads back to you. There's also the performance angle. A router that's busy relaying traffic for strangers is going to be slower. You might notice lag in your connection, or the device might overheat and become unstable. In some cases, the malware can even brick the device entirely. ### What Can You Do About It? Here's the good news: protecting yourself isn't hard. It just requires a little effort. - **Change your default credentials.** This is the single most important step. Use a strong, unique password for your router's admin panel. - **Keep your firmware updated.** Manufacturers regularly patch vulnerabilities. Check for updates at least every few months. - **Disable remote management.** If you don't need to access your router from outside your network, turn this feature off. - **Use a different DNS server.** Some botnets use DNS hijacking to redirect traffic. Switching to a reputable DNS provider can help mitigate this. - **Monitor your network.** If you notice unusual traffic or slowdowns, it's worth investigating. ### The Bigger Picture Evooo1Bot is a reminder that the internet of things is a double-edged sword. Every connected device is a potential entry point. And attackers are getting smarter about how they use these devices. They're not just looking for raw power anymore; they're looking for stealth and utility. The shift from DDoS to proxy networks is significant. It shows a maturation in the cybercrime ecosystem. These botnets are becoming infrastructure for other attacks, not just the attack itself. That makes them more valuable and more dangerous. So, take a few minutes today to check your router. Change the password if you haven't. Update the firmware. It's a small step, but it could save you from being an unwitting participant in someone else's criminal activity. And that's a win for everyone.