New Evooo1Bot malware is quietly turning home routers into criminal traffic relays
Researchers say the Mirai-based botnet has been hijacking gateway devices since July to sell as proxies, steal credentials, and launch attacks.
Key points
- Fortinet has been tracking a new Linux botnet called Evooo1Bot that has been infecting internet-facing routers and gateways since at least July 2024.
- The malware turns compromised devices into SOCKS5 proxies, which are relays that let criminals bounce their traffic through someone else's internet connection.
- Evooo1Bot targets gear from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, D-Link, and adds exploits for Hikvision cameras, Atlassian Confluence, Zyxel firewalls and Kubernetes ingress-nginx.
- The bot reuses the leaked Mirai source code for its denial-of-service engine, which floods websites with junk traffic to knock them offline.
- Owners can defend themselves by updating firmware, changing default passwords, and switching off remote admin access.
There is a new family of botnet malware chewing through the exposed edge of the internet, and if you have an older router sitting behind your TV, this one is worth paying attention to.
Security firm Fortinet has named it Evooo1Bot. As first reported by BleepingComputer, it is a Linux-based bot built on top of the leaked Mirai source code, the same code that powered the huge attacks on internet services back in 2016. The operators have bolted a lot of extra machinery onto it.
In plain terms: it breaks into your router, hides itself, and then rents your internet connection out to criminals.
What is Evooo1Bot actually doing?
It hijacks internet-facing gateway devices and turns them into SOCKS5 relay nodes, which is a way of routing someone else's traffic through your box so it looks like the traffic came from your home. That is valuable to criminals who want to hide where they really are.
The malware also does more than proxy work. It steals login details, tries to guess SSH passwords on other machines (SSH is the remote-login system admins use to manage servers), and can join in on distributed denial-of-service attacks that flood a target website until it falls over.
Evooo1Bot has been active since at least July, hitting devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link across multiple regions. Newer builds add exploits for Hikvision cameras, Atlassian Confluence servers, Zyxel firewalls, TP-Link routers, D-Link network storage, WSO2 products, Kubernetes ingress-nginx (a common piece of cloud plumbing) and vulnerable PHP-CGI installs.
Fortinet notes that some of those exploits are coded badly and simply fail. The failure mode here is sloppy attacker engineering, not a defensive win.
How does it stay hidden?
Once it gets in, the malware checks whether it is running inside a debugger, a sandbox, a virtual machine, a container, or a honeypot (a fake system security researchers set up as bait). If any of those look present, it refuses to run.
If the coast is clear, it talks to its operators over encrypted traffic on port 443, the same port your browser uses for HTTPS, so the chatter blends in with normal web traffic. It installs itself through systemd, SysV init, shell profiles and rc.local, which are all the standard ways a Linux box starts programs at boot. A scheduled task then re-downloads the payload every five minutes, in case anything wipes it.
After a successful break-in, the script clears the Bash history. One thing the post-mortem will say: if you rely on shell history to spot intrusions, you have already lost.
| Module | What it does |
|---|---|
| SOCKS5 relay | Rents the device out as a proxy for criminal traffic |
| SSH scanner | Tries 150 enterprise username and password pairs on other machines |
| Credential sniffer | Reads web logins and cookies passing through the device |
| DDoS engine (Mirai) | 16 flood types including UDP, DNS, SYN and HTTP |
Should ordinary users worry?
Mostly, no, but check your router. If you own any of the listed brands and have not updated the firmware in years, or you still have the default admin password on the box, you are exactly the target.
Four practical steps. Update the firmware from the vendor's site. Change the admin password. Turn off remote management, which is the web login page reachable from the internet. Replace the device if the manufacturer no longer ships security fixes.
In practice, most of the routers feeding botnets like this are five to ten years old and out of support. That is the real problem, and no amount of clever detection fixes it.
