Daily digest

New Mirai-based Evooo1Bot botnet converts routers into SOCKS5 relays

Researchers identified a new modular Linux botnet, Evooo1Bot, based on Mirai code that targets internet-facing gateway devices such as routers. Once compromised, devices are turned into SOCKS5 traffic relay nodes, likely for proxying malicious or anonymized traffic.

Why it matters: Any exposed edge devices (VPN concentrators, branch routers) in scope for CUI networks should be checked for default credentials and unpatched firmware, since compromised gateways can be used to mask attacker traffic and complicate incident attribution during an assessment.