AryStinger Botnet Hijacks 4,300 D-Link Routers for Global Proxy Network

A previously undocumented malware botnet named AryStinger has compromised more than 4,300 outdated routers worldwide. Unlike typical IoT botnets built for DDoS or cryptocurrency mining, this threat converts infected devices into distributed reconnaissance and proxy nodes designed to hide attacker activity and support larger intrusion campaigns. The discovery comes from researchers at Qianxin XLab, who first detected the campaign in March 2026.

What Happened: AryStinger Botnet Turns Legacy Routers Into Global Attack Proxies

On March 12, 2026, Qianxin XLab’s Network-wide Threat Awareness System detected IP address 107.150.106.14 spreading a Linux ELF malware sample through vulnerabilities disclosed more than a decade ago. The sample targeted routers built on Realtek’s RTL819X series chips, hardware that was mainstream between 2012 and 2015.

The attackers exploited CVE-2013-3307 and CVE-2016-5681 to compromise D-Link and Linksys router models that have long reached end-of-life status. Consequently, many affected devices have not received security patches in years. The malware itself had a zero detection rate on VirusTotal at the time of discovery, making it extremely difficult for defenders to spot.

On April 26, 2026, XLab researchers captured a second variant targeting Network Attached Storage (NAS) devices through CVE-2025-11837. This variant is implemented in Go rather than C and includes more advanced reconnaissance capabilities. Based on its behavioral characteristics and source code paths hinting at the project name “Ary-Attack,” the researchers named the malware family AryStinger.

Technical Details of the AryStinger Botnet

AryStinger is not a typical IoT botnet. Most router malware focuses on denial-of-service attacks or mining operations. In contrast, AryStinger is designed for pre-intrusion footprinting. Furthermore, it can be repurposed for lateral movement and traffic relay.

Communication and Control

The malware communicates with its command-and-control (C2) server over HTTP and HTTPS. Network traffic is encoded using Protobuf and obfuscated with simple XOR encryption. The Go-based NAS variant adds gzip compression. After authenticating with the C2 server and receiving configuration updates, infected devices enter a standby state and wait for task assignments.

Task Types and Capabilities

Each infected node, called an Executor, supports a wide range of task types:

• Internal and external network scanning for open ports and services
• DNS scanning and subdomain enumeration
• Traffic tunneling and proxy forwarding to hide attacker origin
• System command execution on infected devices
• Payload execution using Go, Java, or Python source code
• Remote management channels via Dropbear SSH (port 2332 on routers) or gs-netcat (on NAS devices)

Two Builds for Two Targets

The router variant is written in C and is intentionally lightweight because old router hardware cannot support heavier payloads. Therefore, it focuses on mass DNS scanning and traffic tunneling. The NAS variant is written in Go and is significantly more capable. It integrates open-source penetration testing tools including fscan, ksubdomain, httpx, and Tlsx for comprehensive network reconnaissance.

The distributed design allows operators to split large scanning tasks into chunks and distribute them across hundreds or thousands of Executors for parallel execution. Thus, attackers can footprint targets rapidly while hiding behind residential IP addresses.

Persistence and Evasion

The router variant deploys a Dropbear SSH server on a hardcoded port for persistent remote access. The NAS variant uses gs-netcat for stealthier communication. Moreover, the hardcoded XOR encryption key contains the string sh_#@!_2024_secret, leading researchers to speculate that the campaign may have begun as early as 2024.

Business and Operational Impact

The AryStinger botnet poses a multi-layered threat to organizations and individuals alike. The infected routers are not merely passive proxies. They actively participate in attacker reconnaissance and can serve as springboards for deeper network compromise.

• National security implications: China’s Ministry of State Security warned in May 2026 that compromised routers are becoming a key entry point for cyber espionage
• Privacy exposure: The malware can tamper with DNS settings and silently monitor all inbound and outbound traffic on infected networks
• Lateral movement risk: Infected devices inside corporate or home networks provide attackers with internal footholds for further intrusion
• Low detection rate: The malware and its C2 infrastructure have an extremely low detection rate in mainstream security engines, making passive defense difficult
• Potential for DDoS: XLab warns that the distributed DNS scanning infrastructure could be repurposed to flood DNS resolvers with malicious queries

Geographic Distribution and Affected Devices

According to Qianxin’s asset detection data, the infection is heavily concentrated in Asia:

South Korea	48.45%
China	31.82%
Sweden	6.40%
Malaysia	3.50%
Singapore	2.50%

The majority of infected devices are D-Link DIR-850L routers (approximately 75%), followed by DIR-818LW (about 13%). Other affected models include DIR-816L, DIR-818L, DWR-118, and DIR-817LW. These models were previously targeted by the AVrecon malware botnet that Lumen disrupted in 2023.

Mitigation and Recommendations

Defenders should treat legacy routers and NAS devices as high-risk assets. Therefore, organizations and home users should take immediate steps to reduce exposure.

Immediate Actions for Defenders

1. Replace end-of-life routers: Upgrade any D-Link DIR-850L, DIR-818LW, or similar models that are no longer supported by the manufacturer
2. Apply firmware updates: For devices still under support, install the latest available firmware immediately
3. Change default credentials: Replace factory default administrator passwords with strong, unique credentials
4. Disable remote management: Turn off WAN-side administrative panels unless absolutely necessary
5. Monitor for unauthorized SSH services: Scan internal networks for unexpected SSH listeners on non-standard ports such as 2332
6. Review NAS access logs: Check QNAP and other NAS devices for signs of compromise via CVE-2025-11837
7. Segment IoT devices: Place routers, NAS devices, and other IoT equipment on isolated network segments with restricted outbound access

Long-Term Strategic Measures

• Implement network-level monitoring for suspicious outbound HTTP and HTTPS traffic to unknown destinations
• Deploy intrusion detection rules targeting Protobuf-encoded traffic with XOR obfuscation patterns
• Establish a hardware refresh policy to ensure networking equipment does not outlive vendor security support
• Consider threat intelligence feeds that track IoT botnet C2 infrastructure and compromised router indicators

Bottom line: AryStinger is a wake-up call for anyone still running decade-old routers. These devices are not just slow. They are actively being weaponized for reconnaissance, proxying, and intrusion support. Replacing unsupported hardware is no longer optional. It is a security imperative.

Incident Summary

CVE ID / Incident:	AryStinger Botnet (CVE-2013-3307, CVE-2016-5681, CVE-2025-11837)
Affected Systems:	D-Link DIR-850L, DIR-818LW, DIR-816L, DIR-818L, DWR-118, DIR-817LW; Linksys RTL819X routers; QNAP NAS devices
Disclosure Date:	June 21, 2026 (BleepingComputer); XLab first detection March 12, 2026
Patch Status:	End-of-life devices receive no patches; QNAP CVE-2025-11837 patched November 2025
Infection Count:	4,300+ routers confirmed; NAS infections unmeasured
Attribution:	Unknown operator; possible campaign origin as early as 2024

References

1. Qianxin XLab, “More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers,” XLab Blog, June 2026, https://blog.xlab.qianxin.com/arystinger-botnet-hijacks-legacy-routers-for-global-attacks-en/, accessed June 22, 2026.
2. Ravie Lakshmanan, “AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network,” The Hacker News, June 22, 2026, https://thehackernews.com/2026/06/arystinger-malware-infects-4300-legacy.html, accessed June 22, 2026.
3. Bill Toulas, “AryStinger botnet infected thousands of D-Link routers worldwide,” BleepingComputer, June 21, 2026, https://www.bleepingcomputer.com/news/security/arystinger-botnet-infected-thousands-of-d-link-routers-worldwide/, accessed June 22, 2026.
4. Microsoft Threat Intelligence, “From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet,” Microsoft Security Blog, June 19, 2026, https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/, accessed June 22, 2026.