Evooo1Bot Mirai fork deploys SOCKS proxies on six vendor lines via unpatched flaws

The malware extends public Mirai code with three operational upgrades: AES-encrypted command channels, a scanner that discards obvious honeypot banners, and a SOCKS5 proxy module that converts edge devices into persistent relays. FortiGuard observed activity clusters in North America, Europe, India, China and Japan but released no infection counts or CVE mappings. Procurement records and prior Mirai takedowns indicate these same device lines have carried default credentials and unpatched remote-code-execution flaws since 2016. The addition of SOCKS proxy capability shifts the botnet from pure DDoS infrastructure to a distributed pivot platform that can mask follow-on access into internal networks. Independent sinkhole data from earlier Mirai variants showed rapid reuse of leaked source once law-enforcement pressure eased; Evooo1Bot follows the same pattern. No technical indicators yet link the operators to the March 2024 Aisuru-KimWolf disruption. Next observable milestone is whether the proxy layer generates measurable SOCKS traffic spikes on public IPv4 ranges tied to the six vendors; sustained growth above 5 000 unique relays within 90 days would confirm the variant has achieved operational scale.