Evooo1Bot Linux botnet turns internet-facing gateways into traffic relays

A new Mirai-based modular Linux botnet called Evooo1Bot is compromising internet-facing gateway devices and turning them into traffic relay nodes. Once installed, it runs a SOCKS5 proxy on the infected device, letting the operators route their own traffic through the victim's connection to hide the true origin of other activity. Building on the widely reused Mirai code base and a modular design, it targets the kind of routers and gateways that sit exposed at the network edge, often running outdated firmware and weak credentials. Relay botnets like this quietly monetize compromised devices and complicate attribution for whatever traffic passes through them.

Check

Keep internet-facing routers and gateways patched, replace default or weak credentials, disable unnecessary remote management, and watch for unexpected outbound proxy traffic or SOCKS5 services on edge devices.

Affected

Internet-exposed Linux-based routers and gateway devices with weak credentials or outdated firmware; Evooo1Bot enrolls them as SOCKS5 relays, using their connections to anonymize and route other malicious traffic.

Fix

Harden and update edge devices, restrict management interfaces, monitor for proxy and relay behavior and unusual outbound connections, and replace devices that no longer receive firmware support.