A newly identified malware strain known as Evooo1Bot has been exploiting routers and IoT devices across the globe, turning them into tools for distributed denial-of-service (DDoS) attacks and proxy relays. This sophisticated malware, an evolution of the infamous Mirai source code, was first detected by Fortinet's FortiGuard Labs in mid-2026. Evooo1Bot is capable of converting everyday networking equipment into covert infrastructure to facilitate malicious activities by utilizing advanced features such as proxy routing, credential harvesting, and evasion of honeypots. The malware transforms routers and gateway devices into SOCKS5 proxy servers, obscuring the origin of malicious traffic and bypassing regional network restrictions. These compromised devices can further serve as entry points for more extensive network exploitation, leveraging legitimate IP addresses to evade detection. Evooo1Bot uses a multi-stage persistence mechanism, employing systemd service units, SysV initialization scripts, and cron job schedules to maintain long-term control. This persistence complicates the remediation process for system administrators. The malware expands by exploiting remote code execution and command injection vulnerabilities in devices from vendors like D-Link, NETGEAR, Tenda, and others. It also incorporates an automated SSH brute-force scanner to identify system vulnerabilities. The malware obfuscates its command and control communications with layered encryption, blending its traffic with standard HTTPS traffic to avoid detection. The widespread use of proxy-enabled botnets presents significant risks, especially for countries with extensive IoT adoption. Vulnerable residential and small-office routers may serve as entry points for cyberattacks, threatening initiatives like India's Digital India due to potential supply chain security breaches. Authorities have warned about the dangers of not updating hardware and have recommended measures such as enforcing strict access controls, auditing device configurations, and applying firmware updates to mitigate the threat. The rise of Evooo1Bot highlights the need for vigilance, regular updates, and robust security protocols to protect critical network infrastructure.