Evooo1Bot is a Mirai-based modular Linux botnet malware that infects internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. This functionality allows the compromised devices to relay traffic, which can be used for anonymizing malicious activity or other nefarious purposes. The botnet targets Linux-based routers and similar devices exposed to the internet. No specific affected software versions or patches are identified in the available data. There is no current evidence of active exploitation in the wild.

Compromised gateway devices become part of a botnet infrastructure used as SOCKS5 proxy nodes, which can facilitate anonymized malicious traffic or other indirect attacks. This can degrade device performance and network security, potentially enabling further malicious activity through the relayed traffic. However, no direct exploitation or data breach details are provided.

No patch or official remediation guidance is provided in the available information. Network defenders should monitor for unusual SOCKS5 proxy activity on gateway devices and implement network-level controls to restrict unauthorized outbound proxy traffic. Device firmware updates and hardening of internet-facing gateway devices are recommended general best practices but are not specifically confirmed as mitigations for this malware. Patch status is not yet confirmed — check vendor advisories for updates.