New Evooo1Bot Linux botnet turns routers into traffic relay nodes
New Evooo1Bot Linux botnet targets routers, turning them into SOCKS5 proxy nodes.
A new Mirai-based Linux botnet, Evooo1Bot, is targeting internet-facing gateway devices like routers, converting them into SOCKS5 traffic relay nodes. Beyond proxying, it can steal credentials, perform SSH brute-forcing, and launch DDoS attacks by exploiting known vulnerabilities in devices from various manufacturers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Alcatel routers?
Get an email when a new story names Alcatel routers, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Evooo1Bot botnet exploits known, unpatched vulnerabilities in internet-facing routers and gateway devices to conscript them into a SOCKS5 proxy network used for credential theft, DDoS attacks, and SSH brute-forcing. The root cause is a failure to patch and harden edge devices that are directly exposed to the internet — a persistent and well-understood risk. Many organizations neglect firmware and appliance patching with the same rigor applied to servers and workstations, leaving routers as soft targets. This matters because compromised routers provide attackers with a trusted, internal vantage point to pivot deeper into networks and obfuscate malicious traffic origins.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Evooo1Bot
- ip — 443