[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f55ZYWtbNxq_OrpyAiP2HQG9DwaZ7qORigoMq4dTVF10":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":61},"e24408e9-2369-4fa6-afc6-18a516eac5d5","mirai-based-botnet-hijacks-routers-via-known-vulnerabilities","fd1d38ab-b512-4b9f-bf5b-8aba70aadab5","Mirai-Based Botnet Hijacks Routers via Known Vulnerabilities","The Evooo1Bot botnet exploits known, unpatched vulnerabilities in internet-facing routers and gateway devices to conscript them into a SOCKS5 proxy network used for credential theft, DDoS attacks, and SSH brute-forcing. The root cause is a failure to patch and harden edge devices that are directly exposed to the internet — a persistent and well-understood risk. Many organizations neglect firmware and appliance patching with the same rigor applied to servers and workstations, leaving routers as soft targets. This matters because compromised routers provide attackers with a trusted, internal vantage point to pivot deeper into networks and obfuscate malicious traffic origins.","**Immediate actions:**\n- Audit all internet-facing routers and gateway devices and apply the latest manufacturer firmware and security patches immediately.\n- Disable default or weak credentials on all network appliances and enforce strong, unique passwords or key-based SSH authentication.\n- Block unnecessary inbound SSH and management ports at the perimeter firewall to reduce the brute-force attack surface.\n\n**Long-term improvements:**\n- Establish a recurring patch management cycle specifically covering network appliances, IoT, and edge devices.\n- Segment management interfaces of routers and gateways onto a dedicated, access-controlled out-of-band network.\n- Maintain a complete and continuously updated inventory of all network appliances, including firmware versions and end-of-life status.\n\n**Detection measures:**\n- Deploy network traffic analysis tools to detect anomalous outbound SOCKS5 proxy traffic or unexpected lateral movement from edge devices.\n- Configure SIEM alerting for repeated SSH authentication failures indicative of brute-force activity originating from or targeting routers.\n- Subscribe to manufacturer security advisories and threat intelligence feeds to receive early warning of newly disclosed router vulnerabilities.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AC-17: Remote Access","NIST CSF DE.CM-1: Network Monitoring","NIST CSF ID.AM-1: Asset Inventory","MITRE ATT&CK T1090: Proxy — Multi-hop Proxy","MITRE ATT&CK T1110: Brute Force",{},"published","2026-08-15T16:20:23.054797+00:00","2026-08-15T16:20:22.954+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes\u002F","new-evooo1bot-linux-botnet-turns-routers-into-traffic-relay-nodes-2ef1bb","New Evooo1Bot Linux botnet turns routers into traffic relay nodes",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[50,56],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"3906e11d-5241-486e-8cc3-b38db2a141fc","2026-08-17","morning","ThreatNoir Morning Brief — August 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-17\u002Fthreatnoir-morning-brief-2026-08-17.mp3",{"id":57,"date":58,"edition":53,"title":59,"audio_url":60},"de2f9393-a59f-4e83-b26c-e24f4f2cec35","2026-08-16","ThreatNoir Weekend Brief — August 16","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-16\u002Fthreatnoir-morning-brief-2026-08-16.mp3",[62,65,69],{"slug":34,"name":63,"problem":64},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":66,"name":67,"problem":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":46,"name":70,"problem":71},"Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]