In a alarming escalation for perimeter cybersecurity, threat researchers have unmasked a sophisticated, highly modular Linux botnet that actively weaponises internet-facing routers, enterprise gateways, and internet-of-things devices into anonymous traffic relay networks.
First identified by cybersecurity researchers at Fortinet’s FortiGuard Labs in mid-2026, the newly documented malware strain—dubbed “Evooo1Bot”—marks a significant architectural leap over standard Linux threats. While the malware inherits its underlying distributed denial-of-service (DDoS) engine from the publicly leaked 2016 Mirai source code, it incorporates advanced proxy routing mechanisms, credential sniffing capabilities, and honeypot-evasion routines that transform compromised edge hardware into commercial-grade proxy relays.
From Simple Denial-of-Service to Covert SOCKS5 Proxies
Traditionally, Mirai-derived botnets focused almost exclusively on overwhelming web targets through high-volume traffic floods. Evooo1Bot fundamentally diverges from this singular objective by integrating a dedicated SOCKS5 proxy relay module, available in both direct listening and reverse encrypted tunnel configurations.
When deployed, this module converts compromised routers and networking gear into covert entry points. Attackers can funnel malicious network traffic through these compromised nodes, masking their true origin, bypassing regional firewalls, and pivoting deeper into corporate networks under the guise of legitimate residential or enterprise IP addresses.
Beyond its proxy relay infrastructure, the botnet maintains a multi-stage persistence mechanism. Once an edge device is compromised, Evooo1Bot installs persistence simultaneously across multiple system points—including systemd service units, SysV initialization scripts, and automated cron schedules—making full remediation exceptionally difficult for network administrators.
Multi-Vector Exploitation and Honeypot Evasion
The botnet’s expansion relies on a diverse arsenal of remote code execution (RCE) and command injection exploits targeting legacy and contemporary networking hardware from vendors such as D-Link, NETGEAR, Tenda, Telesquare, and Alcatel.
To expand its host count beyond known vulnerabilities, Evooo1Bot also incorporates an automated SSH brute-force scanner. However, unlike unrefined automated scanners, Evooo1Bot executes pre-login and post-login verification checks to detect security honeypots—such as Cowrie or HonSSH—before delivering its secondary payloads. If the targeted device matches known honeypot banner signatures or directory paths, the botnet halts execution to avoid detection by threat intelligence researchers.
The malware further obfuscates its command-and-control (C2) communication through layered AES-256-CTR, ChaCha20, and XOR encryption algorithms, blending its C2 traffic into standard port 443 HTTPS streams to evade perimeter firewalls.
Policy Implications for India’s Expanding Digital Infrastructure
The emergence of proxy-enabled botnets poses acute challenges for digital economies like India, where millions of small-office and residential routers remain unpatched or exposed to the public internet. As the Union Government scales national initiatives under the Digital India campaign and expands enterprise cloud integration, compromised edge infrastructure creates severe security vulnerabilities across domestic supply chains.
The Indian Computer Emergency Response Team (CERT-In) and the National Cyber Security Coordinator have repeatedly warned against unpatched edge devices, emphasizing that compromised domestic hardware is frequently co-opted to launch cyberattacks or disguise financial fraud schemes. Enterprise IT departments and Internet Service Providers (ISPs) across India are advised to enforce strict administrative access controls, audit edge configurations, disable exposed management ports, and swiftly apply firmware updates provided by hardware manufacturers.
