Lumen Black Lotus Labs has exposed how AVrecon infects devices connected to SOHO routers. A stealthy Linux malware called AVrecon has been infecting over 70,000 small office/home office (SOHO) routers, creating a botnet primarily aimed at stealing bandwidth and operating as a hidden residential proxy service.