# Linux Botnet ‘Evooo1Bot’ Turns Everyday Devices Into a Stealth Cyber Attack Network

*Monday, August 17, 2026 at 10:05 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-08-17T10:05:40.805Z (3h ago)
**Category**: cyber | **Region**: Global
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/14739.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A newly documented Linux botnet dubbed Evooo1Bot is infecting routers, firewalls, cameras and other internet-facing devices, turning them into SOCKS5 proxies, DDoS nodes and credential thieves. Building on Mirai-style code but adding credential sniffing and SSH brute forcing, the malware quietly repurposes household and enterprise hardware into a global attack platform. The article explains how it works and what’s at stake for networks that barely know these devices are on their front line.

A new strain of malware is quietly turning the weakest, most forgotten devices on the internet into a potent tool for cyber attackers. Security researchers have identified a Linux botnet dubbed Evooo1Bot that targets routers, firewalls, IP cameras and other exposed edge devices, exploiting known vulnerabilities to conscript them into a distributed network of SOCKS5 proxies. Once infected, these everyday devices can be directed to relay traffic, launch distributed denial-of-service (DDoS) attacks, sniff credentials and brute-force SSH logins, all while their owners may have little idea anything is wrong. Evooo1Bot builds on the long-running Mirai family of malware that has plagued the internet of things for nearly a decade. But…

---

*Full article available with Hamer Intel Pro — https://hamerintel.com/pricing*