Researchers have found that the recently discovered AryStinger botnet has quietly hijacked thousands of end‑of‑life D‑Link routers and some network-attached storage (NAS) devices, turning them into a distributed scanning and proxy network that attackers can use to hide their activity and launch attacks against other targets. 

Having your devices under control of a botnet is not just a problem for the people being targeted. It can also put your own privacy and security at risk. 

The AryStinger botnet is mainly built on compromised D‑Link DIR‑850L and DIR‑818LW routers. Although these devices are long past end‑of‑life, they are still widely used in homes and small offices, making them attractive targets for botnet operators.

The attackers exploited vulnerabilities disclosed 13 years ago to compromise a large number of routers. According to the researchers:

“At least 4,300 routers worldwide have already been infected, and the number is still continuously rising.”

By targeting routers that are no longer supported by the vendor, the attackers gain access to devices that will never receive security patches but remain connected to the internet.

AryStinger turns each infected device into what the researchers call an “Executor”: a remotely controlled node that can scan networks, act as a proxy, create tunnels, and run commands on behalf of the attacker.

The botnet’s controller splits large reconnaissance tasks into many smaller ones and distributes them across these Executors, effectively turning a fleet of consumer routers into a large-scale scanning platform.

The botnet’s primary purpose is reconnaissance at scale. The controller can:

• Push scanning jobs (for IP ranges, open ports, DNS records) down to many Executors in parallel.
• Use those results to map networks, identify new vulnerable services, and prepare further compromises (“footprinting”).

For owners of infected devices, a more worrying capability is AryStinger’s ability to tamper with DNS settings. This allows attackers to:

• Redirect victims’ browser traffic to phishing pages or malware‑hosting sites.
• Silently monitor and potentially steal all inbound and outbound network traffic passing through the router or NAS.

This can put otherwise well-protected devices at risk. Mobile phones, tablets, and laptops connected to the compromised router can be redirected as well.

How to tell if you’re impacted

For owners of an affected router or NAS, the immediate signs may be subtle or non‑existent. Possible indicators might be:

• Slightly slower connectivity
• Occasional unexplained DNS failures or redirects
• Spikes in outbound traffic at odd times

But the underlying risks are serious enough:

• Privacy: Attackers may be able to inspect or redirect your traffic, potentially capturing usernames, passwords, session cookies, or other sensitive data.
• Liability and reputation: Your IP address could be used for fraud, credential‑stuffing, harassment, or other criminal activity, potentially attracting attention from service providers or law enforcement—something already seen in other proxy botnets.
• Pivoting into your network: Particularly on compromised NAS devices, attackers may be able to map internal networks and look for additional systems to target.

What to do

This is not the first time attackers have built a botnet from abandoned networking equipment. Unfortunately, the most effective solution is also the least popular one: Replace end-of-life routers and NAS devices.

If that’s not an immediate option, there are some steps you can take to make your device harder to compromise:

• Apply the latest firmware available for your device, even if it’s old, and review any vendor security advisories for known vulnerabilities.
• Change the default administrator password to a unique, strong password or passphrase; never reuse passwords from other accounts.
• Disable remote management from the internet (WAN). Only access the admin interface from inside your home or office network.
• Use WPA2 or WPA3 wireless encryption and a strong Wi‑Fi password to reduce the chance of local abuse.
• If your router supports it, turn off unused services such as UPnP on the WAN side or legacy remote access protocols.
• Run an anti-malware scan on computers and other devices connected to the router to check whether any were separately infected while traffic was being tampered with.

Even if you apply all of these recommendations, an end-of-life router should be considered untrusted. Make plans to replace it as soon as you can.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

AryStinger hijacks outdated routers via old flaws, turning 4,300+ devices into a stealth network for reconnaissance and intrusion support.

On March 12, 2026, QiAnXin’s XLab threat detection system flagged a single IP address, 107.150.106.14, spreading a Linux binary through two vulnerabilities that were disclosed in 2013 and 2016 respectively. The binary had zero detections on VirusTotal. The devices it targeted were routers built on Realtek’s RTL819X chips, hardware that was mainstream between 2012 and 2015 and has received no firmware updates since. XLab named the malware family AryStinger, based on a source code path hint that the project is called Ary-Attack.

The first thing that sets AryStinger apart is what it doesn’t do. It doesn’t encrypt files. It doesn’t mine cryptocurrency.

“Let’s turn the clock back to March 12, 2026, when the XLab Network-wide Threat Awareness System detected IP 107.150.106.14 spreading a VT 0-detection ELF sample implemented in C through the old vulnerabilities CVE-2013-3307 and CVE-2016-5681″ reads the report published by XLab. “Unlike the common practice of exploiting IoT device vulnerabilities to build DDoS or mining botnets, this campaign aims to build an infrastructure cluster for intrusion reconnaissance activities, possessing information-gathering capabilities such as port scanning, service identification, and subdomain enumeration.”

Each infected router becomes what XLab calls an Executor: a node that receives scan tasks, executes them in parallel with other nodes, and ships the results back to the operator, while hiding the attacker’s real location behind a relay layer.

The infection base currently sits at over 4,300 routers worldwide, a figure XLab says is still rising. It covers only RTL819X devices; the NAS infection scale has no measurement yet. The infected pool is dominated by D-Link hardware, with the DIR-850L accounting for roughly 75% of identified devices. By country, South Korea leads at 48%, followed by China at 32%, then Sweden, Malaysia, and Singapore. None of these are countries that stopped manufacturing security tools. They’re just countries with a lot of old routers that nobody replaced.

The researchers found two separate builds of AryStinger. The RTL819X version is written in C and deliberately stripped down, because the old hardware simply can’t run more. It focuses on mass DNS scanning and traffic tunneling, communicates with its C2 over HTTP using Protobuf-encoded traffic obfuscated with XOR encryption using the hardcoded key sh_#@!_2024_secret, and establishes persistence by downloading Dropbear SSH and running it on port 2332.

A second build, written in Go, appeared on April 26 targeting NAS devices through CVE-2025-11837, a code injection vulnerability in QNAP’s Malware Remover that was demonstrated at Pwn2Own Ireland 2025 and patched in November 2025. Whoever is running AryStinger was exploiting it within five months of the patch. That’s a shorter window than most enterprise patch cycles.

The Go build is considerably more capable. It integrates fscan for internal network scanning, ksubdomain and httpx for subdomain and web service reconnaissance, and Tlsx for TLS fingerprinting. Its most flexible feature is ScriptWork, which executes attacker-supplied source code directly on the infected device.

“ScriptWork supports executing Shell commands as well as source-level Payloads in three categories: Go, Java, and Python.” continues the report. “This design greatly enhances the attacker’s operational flexibility: there is no need to compile binary files separately for different platforms, nor to care about the specific architecture of the target device—it only needs to directly issue the source code to dynamically execute it.”

The downside for the attacker is that source code drops to disk in plaintext and interpreter command lines appear in audit logs, making it more detectable than in-memory binary execution.

The distributed task architecture is the operationally clever part.

“The attacker can split a massive scanning task into multiple small chunks and distribute them to different Executors for parallel execution.” continues the report. “With this distributed-like design, the attacker can efficiently complete the early “footprinting” activities, thereby providing strong assurance for the smoothness and success rate of subsequent intrusion operations.”

XLab confirmed this by running a test device and watching the C2 assign a .ba top-level domain brute-force task with an offset value of 11,654,000,000, placing that specific node at roughly 12% into the length-7 subdomain scanning space. The fleet collectively covers the entire space without any single node doing more than its assigned slice.

The hardcoded key sh_#@!_2024_secret contains “2024,” which may indicate the operation started before XLab’s March 2026 detection. That’s a detail that matters: if the infrastructure has been running since 2024, the reconnaissance data it has already collected could be substantial. XLab hasn’t attributed AryStinger to any known threat actor and says the investigation is ongoing.

“Although many mysteries surrounding AryStinger remain to be solved, the mere fact of its targeted attacks against old routers is enough to define it as a real threat not to be underestimated.” continues the report.

“As a key device for daily internet access, once a router is illegally compromised, it will not only threaten personal privacy and property security, but may even endanger national security.” the Ministry of State Security warned. 

The operational pattern, end-of-life routers compromised through n-day vulnerabilities and turned into relay infrastructure for the pre-intrusion phase, matches what Mandiant and others have documented as Operational Relay Box networks, or ORBs, used by state-linked actors.

“Even more concerning is that this malicious sample and its associated C2 servers have an extremely low detection rate in mainstream security engines.” states the report. “It is precisely in view of the compounded risk of this “low detection rate” and “high potential harm” that we decided to write this article and share our research findings with the security community, in the hope of jointly addressing potential risks and safeguarding overall network security.”

Whether AryStinger is state-sponsored or criminal infrastructure being sold as initial access capability, the model is the same: forgotten hardware, ancient CVEs, quiet and hard to detect.

The remediation guidance is straightforward. Check for outbound connections to AryStinger’s C2 and download infrastructure, primarily ajb8.com, dataexplore.cc, and dataexplore.co hostnames. Check /tmp/bin for binaries you didn’t put there. Look for processes named syswapd0h or syswapd0w. The lasting fix is the one that never gets implemented fast enough: retire hardware that stopped receiving firmware updates years ago. A router running code from 2015 is not a network security device. It’s a vulnerability with an ethernet port.

“Once compromised by malware like AryStinger that possesses reconnaissance and covert control capabilities, it is equivalent to a hacker placing a permanent “invisible listening device” and “attack springboard” within your network.” concludes the report. “There is no doubt that when a large number of old devices are gradually compromised and aggregated, ultimately forming a massive covert botnet, this will pose a continuous, covert, and highly destructive real threat to personal privacy, enterprise security, and even national critical network infrastructure.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)