A new botnet called Evooo1Bot is quietly turning home and office routers into hidden traffic-relay nodes. Discovered by Fortinet researchers, the malware builds on the leaked Mirai botnet code but adds a much wider toolkit: a SOCKS5 proxy module that lets attackers route their traffic invisibly through your router, an SSH brute-force scanner, a credential sniffer that monitors network traffic for passwords, and a full DDoS engine capable of 16 different flood methods.
Since at least July 2026, Evooo1Bot has been exploiting known vulnerabilities in devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link. Newer builds add exploits targeting Hikvision cameras, Zyxel firewalls, Atlassian Confluence servers, TP-Link routers, and D-Link NAS devices. Once inside, the malware establishes multiple persistence mechanisms — systemd, startup scripts, and a cron job that re-downloads itself every five minutes — and communicates with its command server over port 443 (the same port as normal HTTPS traffic) to blend in with regular internet traffic. Operators get an interactive shell with direct control over compromised devices and can open multiple simultaneous proxy sessions, which makes the botnet attractive to residential proxy services.
How to check if you’re affected
Affected devices include routers and IoT hardware from NETGEAR, Tenda, D-Link, Alcatel, Mitsubishi Electric, and Telesquare that are running outdated firmware. Check your router’s admin panel for the current firmware version and compare it against the manufacturer’s latest release — if you haven’t updated in over a year, you’re likely running a vulnerable version. If remote administration is enabled in your router settings, disable it unless you have a specific need for it. Replace default admin credentials with a strong password. Devices that have reached end-of-life with no more firmware updates should be replaced.