Router-based botnets aren't new, but each fresh strain reveals something about the state of edge-device security — and this one, dubbed Evooo1Bot, appears squarely aimed at converting compromised Linux routers into traffic relay nodes. That's a meaningful distinction from classic DDoS botnets. Relay-node infections are the raw material of residential proxy networks, credential-stuffing infrastructure, ad fraud pipelines, and increasingly, laundering layers for AI scraping traffic that gets blocked when it comes from cloud IP ranges.

What a technical reader will likely find in the BleepingComputer writeup:

• Initial access vectors — probably a mix of default credentials, unpatched CVEs in consumer router firmware (TP-Link, D-Link, MikroTik, and the usual suspects), and exposed management interfaces.
• Payload architecture — a small Linux binary, often statically linked for MIPS/ARM, that establishes a persistent outbound tunnel and registers with a C2 for relay assignments.
• Traffic proxying protocol — SOCKS5 is the community favorite; some newer families are wrapping it in TLS or WebSockets to blend with normal browsing.
• Monetization — access sold wholesale to "residential proxy" resellers, which is how compromised grandma's router ends up serving scraping traffic to a Fortune 500 e-commerce competitor.

The underrated angle here is the economic shift. Detection and takedown work on volumetric DDoS botnets has improved significantly. But relay botnets are quieter by design — a few kilobits per second per node, indistinguishable from a Netflix stream in aggregate — and the residential-proxy market has an insatiable, legally-gray demand. That makes them harder to justify prioritizing for ISPs and much more profitable for operators.

For anyone running a home lab, a self-hosted network monitoring stack, or edge infrastructure: this is exactly the kind of infection your ntopng flow data can catch — persistent outbound connections to unusual ASNs, unexpected SOCKS-shaped traffic patterns, or a router with steady low-bandwidth egress at 3 a.m. Worth watching for.