Mirai Grew Up. Your Router Is Now Someone Else’s Proxy Infrastructure.
For years, the basic IoT botnet model was easy to understand.
Compromise thousands of weakly protected devices.
Combine their bandwidth.
Point them at a target.
Launch a denial-of-service attack.
Mirai made that model famous.
The next generation of edge-device malware is becoming more useful.
Research into the Evooo1Bot campaign describes malware targeting internet-facing routers and other embedded systems while adding capabilities beyond conventional DDoS behaviour, including command execution, credential collection, SSH brute forcing and SOCKS5 proxy functionality.
That last capability changes the value of the compromised device.
A router is no longer simply participating in somebody else’s attack.
It can become part of somebody else’s infrastructure.
A residential IP address is valuable
Attackers have a constant problem.
Infrastructure gets blocked.
Cloud-provider addresses acquire poor reputations.
VPN endpoints are identified.
Known malicious servers appear in threat-intelligence feeds.
A compromised router solves several of those problems.
Traffic appears to originate from a legitimate residential, branch-office or small-business connection.
To external services, it may look almost indistinguishable from ordinary user traffic.
The router becomes a proxy.
The attacker gains an IP address that belongs to somebody else.
And the owner may never realise that anything has changed.
Edge devices are ideal hiding places
Routers occupy an unusually useful position.
They see traffic entering and leaving the network.
They are continuously powered.
They rarely run endpoint-security agents.
Their logs may never reach the SOC.
They are patched inconsistently.
Some remain operational for years after meaningful security support has ended.
From an attacker’s perspective, that is attractive infrastructure.
An infected workstation is likely to trigger EDR.
An infected router may simply continue routing packets.
That invisibility is valuable.
The attack is not necessarily against the router owner
This changes the way organisations should think about compromise.
Historically, the obvious concern with a vulnerable router was that somebody might use it to enter the network behind it.
That remains true.
But an attacker may not care about the internal network at all.
The device itself may be the asset.
Its bandwidth.
Its IP address.
Its network position.
Its ability to proxy traffic.
This creates an unusual victim relationship.
The organisation whose device is compromised may suffer very little immediate disruption.
The victims of the attacker’s later operations may be somewhere else entirely.
Attribution becomes harder
Proxy infrastructure also complicates investigations.
Logs show an attack originating from an ordinary broadband connection.
The IP address belongs to a legitimate company.
The company denies conducting the attack.
All three statements can be true.
That matters for threat intelligence.
An IP address is an indicator.
It is not automatically an attacker.
As botnets become increasingly capable of providing general-purpose proxy infrastructure, reputation-based blocking becomes less reliable and attribution based purely on source infrastructure becomes more dangerous.
Forgotten infrastructure is becoming security debt
Most organisations have devices that work perfectly well but no longer receive much attention.
Small branch routers.
Legacy VPN appliances.
Old NAS devices.
Internet gateways in remote locations.
Industrial modems.
The business case for replacement is often weak because the equipment still performs its function.
Security changes that calculation.
The question is no longer:
Does this device still work?
It is:
Can we still trust it to sit at the edge of the organisation?
A device can be operationally functional while being strategically obsolete.
That distinction needs to become part of lifecycle management.
Asset management matters more than malware signatures
The immediate defensive response to campaigns such as Evooo1Bot is predictable.
Patch vulnerable equipment.
Disable unnecessary remote-management interfaces.
Restrict administrative access.
Replace unsupported devices.
Those actions matter.
But they depend on something less glamorous.
Knowing the device exists.
Edge-device compromises repeatedly expose the same weakness: organisations have better inventories of laptops than they do of the infrastructure connecting those laptops to the internet.
If an organisation cannot answer which routers, gateways, NAS systems and remote appliances it exposes externally, it cannot reliably manage their vulnerabilities either.
Mirai’s real legacy
Mirai demonstrated that millions of small devices could collectively become powerful attack infrastructure.
The next evolution is more interesting.
Those devices do not merely provide bandwidth.
They can provide access, persistence, credentials, network position and anonymity.
The router under somebody’s desk may appear irrelevant to an attacker targeting a multinational corporation on the other side of the world.
It is not.
It may be exactly the infrastructure they need.
