# Evooo1Bot Linux Botnet Turns Routers Into SOCKS5 Relays

> A new Mirai-based modular Linux botnet called Evooo1Bot targets internet routers, turning them into SOCKS5 traffic relay nodes.

- Published: 2026-08-15T16:14:07.000Z
- Severity: medium
- Category: Malware
- Tags: DDoS, Credential Theft, D Link, TP Link, Mirai
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes/
- Canonical: https://runtimerebel.com/blog/evooo1bot-linux-botnet-turns-routers-into-socks5-relays

## Key points

- Immediate impact: internet-facing gateway devices and routers are being compromised and turned into SOCKS5 traffic relay nodes.
- Affected systems: devices from manufacturers including Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, Hikvision, Zyxel, and TP-Link.
- Remediation: keep firmware updated, replace default administrator credentials, and disable unnecessary remote access panels on all network gateway devices.

A newly discovered modular Linux [botnet](/glossary#botnet) named Evooo1Bot is actively targeting internet-facing gateway devices and routers to weaponize them into SOCKS5 traffic relay nodes. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes/), researchers at Fortinet uncovered the [malware](/glossary#malware), which has been operational since at least July. While the [threat actor](/glossary#threat-actor) leverages the distributed denial-of-service engine from the publicly leaked Mirai source code, the malware introduces a significantly expanded capability set designed for [persistence](/glossary#persistence), [credential harvesting](/glossary#credential-harvesting), and traffic proxying.

## Technical Analysis of Evooo1Bot

Evooo1Bot extends traditional internet-of-things malware frameworks by incorporating an integrated [exploit](/glossary#exploit) arsenal, encrypted command-and-control communications over port 443, and extensive defense-evasion checks. Before executing on a newly compromised host, the malware scans for debuggers, security tooling, sandboxes, virtual machines, containers, and honeypots.

### Core Modules and Capabilities

Once [initial access](/glossary#initial-access) is secured by exploiting known vulnerabilities across various vendor hardware, a script downloads one of twelve architecture-specific builds and clears the Bash history to remove forensic artifacts. Persistence is established through systemd, SysV init, shell profiles, and rc.local entries, backed by a cron job that attempts [payload](/glossary#payload) recovery every five minutes.

* **SOCKS5 Relay Module:** Supports direct listening and reverse-relay modes, allowing operators to route malicious traffic through residential connections and monetize the infrastructure.
* **Credential Sniffer:** Monitors `/proc/net/tcp` to intercept HTTP Basic Authentication and Cookie headers from local traffic.
* **[SSH](/glossary#secure-shell-ssh) Brute-Force Scanner:** Utilizes a wordlist of 150 enterprise-oriented credential combinations alongside post-login checks to avoid honeypots.
* **[Vulnerability](/glossary#vulnerability) Exploitation Arsenal:** Newer builds target Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link Network Attached Storage devices, WSO2 products, Kubernetes ingress-nginx instances, and vulnerable PHP-CGI installations.
* **Distributed Denial-of-Service Engine:** Inherits 16 distinct flood methods from Mirai, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and customizable HTTP floods.

## Actionable Defense and Mitigation Strategies

Defenders managing internet-facing gateway devices and enterprise edge equipment should prioritize specific [hardening](/glossary#hardening) steps to prevent router compromise and botnet enrollment. Because Evooo1Bot relies on known vulnerabilities and default configurations, administrative hygiene significantly reduces exposure.

* Update device [firmware](/glossary#firmware) immediately to [patch](/glossary#patch) known vulnerabilities targeted by automated exploit scanners.
* Replace all default administrator credentials with strong, unique passphrases to stop automated brute-force attempts.
* Disable remote management panels on public-facing network interfaces unless strictly necessary, restricting administrative access to trusted internal management subnets.
* Decommission and replace network hardware that has reached end-of-life status and no longer receives vendor security updates.

**Related:** [Tengu Botnet Exploits Linux Watchdog for Reboot-Based Persistence](/blog/tengu-botnet-exploits-linux-watchdog-for-reboot-based-persistence), [BioShocking Attack: AI Browsers Leak Credentials Via Deception](/blog/bioshocking-attack-ai-browsers-leak-credentials-via-deception)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/evooo1bot-linux-botnet-turns-routers-into-socks5-relays