A new Mirai-derived botnet is quietly converting internet-facing routers into proxy infrastructure. Dubbed Evoo1Bot, the malware takes the well-worn Mirai DDoS engine and adds a feature attackers have been wanting for years: it turns each compromised device into a SOCKS5 relay, so criminals can push traffic through networks they never expected to host it.
Security researchers detailed the malware after watching it target gateways and other exposed Linux devices. The twist here is less about raw attack power and more about abuse of network placement. A home router sitting on a residential connection is not a prized target for its compute. It is prized because of where it sits, and Evoo1Bot exploits exactly that.
A Mirai base with a proxy grafted on
Evoo1Bot does not reinvent the wheel. It reuses the Mirai DDoS engine, which is years old and widely understood, then layers new capability on top. That gives the operators the immediate ability to run floods against targets, but the headline feature is the SOCKS5 proxy component. Once installed, the compromised device can pass traffic through itself, which matters far more than a few extra gigs of attack capacity.
The malware communicates with its command-and-control servers over port 443 using encrypted channels, a deliberate choice to hide in plain sight. Port 443 is HTTPS, the same traffic normal web browsing generates. To a network monitoring tool that is not looking closely, encrypted C2 from a router blends in with everything else.
How it gets in and stays in
Infection starts with an SSH brute-force scanner baked into the malware. The scanner cycles through more than 150 username and password combinations, testing the kind of default credentials that routers ship with and owners never change. It also carries a honeypot check, so it avoids wasting effort against defender bait.
The weaponized devices include a long list of familiar vendors: Alcatel, NETGEAR, Tenda, D-Link, Hikvision, Zyxel, and TP-Link among them. Any internet-facing gateway with default or weak credentials and an exposed management interface is a candidate.
Persistence is handled with the usual kitchen sink. The malware installs itself through systemd, SysV init, shell profiles, and rc.local, then layers on a cron job that re-downloads the payload every five minutes. Even if one mechanism is removed, the next re-downloads the body back onto the box.
The credential theft nobody asks for
What makes this one memorable is the browser side. The malware monitors /proc/net/tcp in the Linux kernel to sniff HTTP Basic Authentication headers and cookie values that pass through the compromised device. A router holding a residential connection sees a huge volume of plaintext, and a device sitting on the forwarding path can lift credentials from routine browsing traffic.
That flow is something different operations do on purpose, but for the victim it expands the damage from an outage to someone holding session cookies and passwords.
Why the SOCKS5 relay matters
The proxy function is what changes the threat model. With a fleet of residential proxies, attackers can position malicious traffic from IP ranges consumers trust. That defeats IP-based reputation filters many platforms rely on, and it complicates attribution. Law enforcement tracing malicious connections ends up at a compromised consumer router in some other country, not at the operator.
There is also an active and growing market for residential proxies. Botnets of this type can be rented out as proxy services, giving the operators a steady revenue line independent of any DDoS campaign.
What defenders should check
The pattern here should be familiar by now, since it is the same advice defenders have had to repeat since the first Mirai outbreaks. First, inventory every device on the perimeter. You cannot secure what you cannot account for.
Then change the defaults. Credentials like admin and 1234 and pub still account for an enormous share of botnet infections, because nobody replaces them at deployment. If a device still has the sticker password on it, that part of your network is already working for someone else.
Finally, disable remote management interfaces you do not need. Many routers expose a web management interface to the internet because the factory default enables it, and no normal home or small office uses it day to day. Close that and one whole infection path disappears.
Monitoring for the relay side
Look for the relay side of the behavior. Egress SOCKS5 proxies generate connections that start at an edge device and fan out to many destinations on port 443, often with no corresponding inbound requests. Alerts that watch for a single router talking to dozens of new external hosts at once will catch the proxy relay even when the malware’s persistence hides the initial infection.
On the monitoring side, the kernel-level credential harvesting means sensitive browsing over these devices should be a red flag. If a gateway starts showing basic-auth and cookie capture behavior, treat it as already lost and rebuild it from known clean firmware.
The bottom line
Evooo1Bot is not a particularly original bit of code, and that is not the point. Mirai lineage plus a proxy plus encrypted C2 is an effective low-cost recipe, and the residential network placement makes the damage disconnect far beyond the infected device. The fix is the unglamorous one: patch the edge, kill default credentials and management interfaces, and watch what the routers do when they claim to be idle.