Evooo1Bot, the New Mirai Variant Turning Routers into Proxies for Attackers

Linux Botnet Targets Internet-Exposed Devices

Evooo1Bot is a new Linux variant derived from the Mirai botnet code. FortiGuard Labs reported its activity on August 13, 2026, describing it as a seemingly undocumented threat.

The botnet exploits unpatched vulnerabilities in routers and other hardware devices directly accessible from the Internet. The activity has been ongoing for at least a month, although the number of compromised devices worldwide remains unknown.

Researchers’ telemetry shows connections or infection attempts in North America, South America, Europe, India, China, and Japan. This geographic distribution points to a broad campaign, although it cannot by itself determine the number of victims.

The affected devices are manufactured by:

• Alcatel;
• D-Link;
• Mitsubishi Electric;
• Netgear;
• Tenda;
• Telesquare.

The exact product versions involved have not been disclosed. No CVE identifiers or specific CVSS score have been associated with Evooo1Bot’s activity.

From DDoS Attacks to Operational Device Control

Like many Mirai variants, Evooo1Bot can use infected devices to launch DDoS attacks. However, the malware adds capabilities that significantly increase the value of compromised devices to their operators.

Communications with the command-and-control infrastructure, or C2, are encrypted. This makes the exchanges harder to identify by inspecting traffic contents and can hinder monitoring tools without adequate inspection capabilities.

The malware also includes a scanner focused on SSH services or code. This feature may be used to identify additional targets accessible through the protocol, increasing the chances of propagation or access to further systems.

Evooo1Bot also attempts to detect honeypots—systems designed to attract and monitor attackers. Avoiding these environments helps the botnet reduce the risk of having its behavior analyzed under controlled conditions.

Another component searches for default credentials that remain enabled on devices. Routers, IP cameras, firewalls, and edge devices deployed without changing their initial passwords can therefore provide another entry point.

The combination of encryption, SSH scanning, honeypot detection, and default-credential harvesting sets Evooo1Bot apart from simpler Mirai variants. It is not merely a network used to generate malicious traffic: the malware seeks to maintain more discreet and persistent control over compromised devices.

SOCKS Functionality Is the Most Significant Risk

The most important operational feature is support for the SOCKS protocol. A compromised device can be configured as a proxy and relay attackers’ connections to other servers.

In practice, the traffic does not originate directly from the attacker-controlled infrastructure. Instead, it passes through the victim’s router, firewall, camera, or other device. To destination systems, the apparent source of the connection may therefore be the address of the compromised organization.

This capability provides several advantages to attackers. The device can be used to conceal the true origin of activities, reach services that accept connections from the edge device, or create a pathway into internal networks.

A router or firewall positioned at the network perimeter may have visibility into and access to resources that are not publicly exposed. If the device is turned into a persistent proxy, it can support reconnaissance, traffic relaying, and subsequent operations.

It is not known whether every infection is used for lateral movement or internal access. However, the presence of this capability increases the potential impact beyond a compromise limited to DDoS activity.

Why Edge Devices Are Targeted

Targeted devices often have three characteristics that favor botnet propagation: they remain continuously connected, perform essential functions, and may stay exposed for extended periods.

A vulnerable Internet-facing device can be reached without first compromising an internal computer. If it also retains default credentials, attackers may have a second access method even after a partial remediation.

Compromise can be difficult to detect. A router or camera may continue to perform its normal function while simultaneously scanning for targets, maintaining encrypted C2 communications, or relaying SOCKS connections.

Indicators to investigate include unexpected SSH traffic, encrypted connections to unusual destinations, and proxy traffic originating from devices that should not provide SOCKS services. Anomalous changes to DNS settings, firewall rules, or active processes also warrant review.

The absence of noticeable performance degradation does not rule out infection. Proxying and concealment capabilities can be used without immediately generating a visible DDoS attack.

Mirai Reuse Continues to Generate New Threats

Mirai’s source code was published in 2016. Since then, it has been reused to create numerous variants adapted to new devices, credentials, and vulnerabilities.

Evooo1Bot follows this pattern, but with a profile more focused on persistence and the operational use of compromised infrastructure. Other cited descendants include Aisuru and KimWolf.

In March, agencies from the United States, Canada, and Germany took action against these two threats. In May, a Canadian man was indicted on charges of operating KimWolf.

These precedents show that Mirai-derived botnets are not merely short-lived, automated campaigns. They can support organized infrastructure, attract law-enforcement attention, and serve as tools for proxy services, distributed attacks, and unauthorized access.

It is not known whether Evooo1Bot is directly linked to Aisuru, KimWolf, or other previously observed groups.

What Administrators Should Do

The first step is to apply all available updates provided by the manufacturers of the affected devices. Because the exact versions involved have not been disclosed, administrators should review every Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda, and Telesquare model listed in their inventories.

Default credentials must also be replaced immediately with unique, strong passwords. The malware’s active search for initial accounts and passwords makes leaving factory settings unchanged particularly risky.

Nonessential administrative services should be removed from direct Internet exposure. Where possible, access should be restricted through VPNs, allowlists, network segmentation, and specific firewall rules.

Security teams should monitor:

• SSH connection attempts to unusual destinations;
• Encrypted C2 traffic originating from edge devices;
• SOCKS connections or unauthorized proxy behavior;
• Scanning activity originating from routers, firewalls, and cameras;
• Unexpected changes to DNS, firewall, and system configurations.

A suspicious device should be isolated from the network and analyzed according to established organizational procedures. A simple reboot may not be sufficient to rule out reinfection, especially if the original issue—a publicly exposed vulnerability or unchanged credentials—remains unresolved.

It is not known whether Evooo1Bot has been added to CISA’s KEV catalog. As a result, no listing date or specific remediation deadline for federal agencies has been reported. The threat nevertheless remains concrete for any organization operating vulnerable devices that are directly reachable from the Internet.