- A new malware called AryStinger has infected at least 4,300 older home routers, according to research from QiAnXin’s XLab.
- Instead of creating a typical DDoS botnet, it turns compromised devices into a distributed reconnaissance and proxy network for attackers.
- The campaign primarily targets routers with Realtek’s RTL819X chips, exploiting old vulnerabilities like CVE-2013-3307 and CVE-2016-5681.
- A separate strain also targets QNAP NAS devices through a patched flaw, CVE-2025-11837.
A new malware family dubbed AryStinger is hijacking thousands of old home routers, according to a report from QiAnXin’s XLab published on June 22, 2026. This campaign repurposes forgotten devices into a stealthy network for scanning and traffic tunneling, marking a shift from typical DDoS-focused botnets. The operation leverages decade-old hardware vulnerabilities to establish its foothold.
Consequently, infected routers become footprinting nodes that conceal the attacker’s true origin. They perform mass DNS scanning, fingerprint services, and relay commands on demand. XLab first observed the malware spreading from a single IP address on March 12, 2026.
The infected pool is dominated by D-Link routers, with the DIR-850L model comprising about 75 percent. Geographically, most infections are located in South Korea and China. Meanwhile, a second strain targeting QNAP NAS boxes appeared in late April.
This strain exploits CVE-2025-11837, a code injection flaw patched months prior. The malware’s architecture includes two distinct builds tailored for different hardware capabilities. A lighter C version runs on resource-constrained routers, while a more robust Go version operates on compromised NAS devices.
The Go build can execute attacker-supplied source code directly on the infected system. Persistence is achieved through a backdoored SSH server with a hardcoded key. This operational model resembles other documented proxy networks used for espionage.
Mandiant has previously tracked similar operational relay box networks, or ORBs, used by state actors. The ultimate fix remains retiring end-of-life hardware that no longer receives security updates. Users should also disable remote administration on any exposed network devices.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
