Evooo1Bot: Mirai-derived botnet repurposing home routers as anonymous traffic proxies
A new modular Linux botnet based on Mirai code is compromising internet-facing routers and converting them into SOCKS5 relay nodes, enabling attackers to route traffic through victim networks. This expands the traditional botnet threat model from DDoS-only to infrastructure-as-a-service for anonymous connectivity.
Affected
Evooo1Bot represents a tactical shift in how threat actors monetise compromised IoT infrastructure. Rather than restricting botnet capabilities to volumetric DDoS attacks, this Mirai derivative has adopted a modular architecture that repurposes infected routers as SOCKS5 proxy relays. This allows operators to sell or lease proxied traffic access to downstream threat actors seeking to mask their origin or distribute malicious connections across numerous egress points.
The targeting of internet-facing gateway devices is operationally rational: routers occupy a privileged network position, remain powered continuously, often run unpatched Linux kernels, and lack visibility from endpoint detection tools focused on servers and workstations. Once compromised, they provide both bandwidth and address reputation that is difficult for defenders to block without collateral damage to legitimate users.
The modular design indicates this botnet is intended for rental or resale to other criminal operations. This mirrors trends observed in the ransomware and exploit broker markets, where initial access is decoupled from payload delivery. Defenders should anticipate that Evooo1Bot nodes may host rotating payloads or be leased to multiple threat groups simultaneously, complicating attribution and incident response.
Organisations should prioritise immediate patching of internet-facing routers, enforcement of strong default credentials, and network segmentation that isolates gateway devices from systems holding sensitive data. ISPs and hosting providers should monitor for unusual egress patterns consistent with SOCKS proxy abuse (high connection churn, unusual port combinations, or traffic originating from home-class IP blocks). The absence of CVE references in the source material suggests either novel exploitation techniques or compromise via weak credentials rather than zero-day vulnerability.
This development underscores why IoT-targeted DDoS-as-a-Service botnets remain economically viable: the marginal cost of extracting additional value from compromised devices through proxy rental is near-zero. Until router security improves at the manufacturing or ISP default-hardening level, expect further variants adopting similar relay-based monetisation models.
Sources