Plan
active
Evooo1Bot Linux botnet hijacks routers as SOCKS5 relay nodes
- Engineer — Plan: Audit internet-facing gateway devices and routers for signs of Mirai-variant compromise; harden by restricting management interfaces, disabling unused services, and ensuring firmware is current — no active KEV or PoC signals yet to force immediate action.
- SOC/IR — Plan: Build or tune detections for anomalous SOCKS5 proxy traffic originating from edge/gateway devices; hunt for unexpected outbound relay behavior on routers in your estate since no specific IOCs are currently published.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.