Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies

Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. "While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including

The article reports on Evooo1Bot, a newly identified Linux botnet based on Mirai code that compromises internet-facing edge devices and repurposes them as SOCKS5 proxies for attacker-controlled traffic. This is a traditional malware/botnet campaign targeting infrastructure, not an AI or LLM system, and the report does not describe any machine learning models or AI components being used or attacked. From a RealGround perspective, the main implication is that the same compromised infrastructure and proxy networks can later be used to hide and route abusive AI-agent activity or large-scale automated attacks against AI APIs. RealGround would therefore treat this as contextual infrastructure risk relevant to planning Continuous AI Red Teaming, where testing scenarios should assume adversaries can operate through large anonymized botnet proxy layers.