BleepingComputer reported on August 15, 2026 that FortiGuard Labs is tracking Evooo1Bot, a Mirai-based Linux botnet targeting internet-facing routers, cameras, firewalls, NAS devices, and other edge systems. Fortinet's research says the malware can do more than launch traffic floods. It can persist on infected devices, sniff credentials, brute-force SSH, and turn compromised systems into SOCKS relay nodes.
That last detail matters for business owners. A forgotten router, camera, firewall, or appliance is not just old equipment if it is exposed to the internet. It can become someone else's infrastructure, making your connection part of a larger attack path or a relay for traffic you did not authorize.
The Business Risk Is Ownership, Not Just Malware
Small organizations often treat edge devices as background plumbing. If the internet works, the router stays. If the camera feed works, the camera stays. If a firewall was installed years ago by a previous provider, it may stay until something breaks.
The Evooo1Bot router botnet story is a useful prompt because it turns that habit into a business decision. Owners do not need to memorize every CVE in Fortinet's report. They do need to know whether the business has an edge device inventory, whether those devices still receive firmware updates, and whether any management panels are reachable from the internet.
Questions To Ask Your IT Provider
- What devices are on the edge of our network? Include routers, firewalls, wireless controllers, IP cameras, NAS devices, phone adapters, remote access appliances, and anything else reachable from outside.
- Which devices are still supported by the vendor? Small business router firmware and appliance updates are only useful when the device still receives them.
- Which management interfaces are exposed? Remote administration, SSH, web management, VNC-style access, and vendor cloud portals should all have a named owner and a business reason.
- Are default or shared credentials still in use? The Fortinet report describes SSH brute forcing and credential-sniffing capabilities, which makes account hygiene part of the device review.
- What is the network device replacement plan? If a device cannot be patched or monitored properly, replacement may be cheaper than repeatedly accepting the risk.
What Owners Can Approve Next
A practical next step is to request a short edge device inventory with three columns: device, exposure, and action. The action might be patch, disable remote access, change credentials, add monitoring, retire the device, or replace it by a specific date.
For New Jersey businesses, this is not about buying a new box every time a botnet appears in the news. It is about making sure internet-facing router security has an owner before an old device becomes a quiet liability. The inventory is where optimism meets the blinking lights.
Ask for proof, not just reassurance. A good answer should show what was checked, what was fixed, what could not be fixed, and who owns the next decision.
Sources and further reading
