AryStinger Botnet Infects Thousands of D-Link Routers Worldwide
A new botnet named AryStinger has infected over 4,000 D-Link routers, primarily DIR-850L and DIR-818LW models, exploiting old vulnerabilities to turn them into proxies for malicious traffic.
Researchers at Qianxin XLab have discovered a new botnet named AryStinger that has infected over 4,000 D-Link routers worldwide. The malware primarily targets outdated DIR-850L and DIR-818LW models, exploiting older vulnerabilities including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837 to compromise devices that are no longer receiving firmware updates.
AryStinger converts infected routers into remotely controlled 'executors' that can perform scanning, proxying, tunneling, and command execution on behalf of the attacker. According to XLab, 'the attacker can split a massive scanning task into multiple small chunks and distribute them to different Executors for parallel execution,' enabling efficient footprinting for subsequent intrusions.
Beyond using compromised routers as a springboard, the malware can tamper with DNS settings to hijack browsing and silently monitor all inbound and outbound network traffic. This allows attackers to steal sensitive data or redirect users to malicious sites.
Telemetry data shows that nearly half of all infections are in South Korea (48.5%), followed by China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%). The two router models were previously targeted by the AVrecon malware botnet, which was disrupted in 2023.
XLab identified two variants of AryStinger: a C-based version targeting routers and a more advanced Go-based version targeting NAS systems. The NAS variant includes additional capabilities such as IP and DNS scanning, command execution, and internal network reconnaissance through integration of open-source penetration testing tools.
The researchers did not attribute AryStinger to any known threat actor, stating that 'many mysteries surrounding AryStinger remain to be solved.' Owners of end-of-life routers are advised to replace them with actively supported models, apply the latest firmware, change default passwords, and disable remote management.
XLab attributed the infections to a malware family they named AryStinger, which exploits three distinct CVEs — including two from 2013 and 2016 targeting Linksys and D-Link routers, and a more recent QNAP Malware Remover flaw (CVE-2025-11837) patched in November 2025. The campaign’s infected fleet is overwhelmingly D-Link DIR-850L hardware (75%) concentrated in South Korea (48%) and China (32%), with a separate Go-based build for QNAP NAS devices that can execute attacker-supplied source code on the box. XLab identified persistence mechanisms including a Dropbear SSH server on port 2332 for routers and gs-netcat for NAS, along with a hardcoded key referencing 2024 that may indicate earlier activity.
A new Malwarebytes report adds practical detection and risk details for owners of compromised D-Link devices. The botnet can tamper with DNS settings to redirect victims to phishing sites and monitor all network traffic, including traffic from phones and laptops connected to the router. The article also provides specific mitigation steps—such as disabling WAN-side remote management and running anti-malware scans on connected devices—while stressing that replacing unsupported hardware is the only definitive fix, since no security patches exist for these end-of-life models.
The new article from Qianxin XLab provides additional technical details on the AryStinger botnet, including the specific CVEs exploited (CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837) and the discovery of two distinct versions: a C-based RTL819X variant for routers and a Go-based Standard version targeting NAS devices. It also reveals that the campaign may have been active since 2024, based on an embedded encryption key, and provides a comprehensive list of indicators of compromise.
New research from XLab - QiAnXin Technology reveals that the AryStinger botnet has infected at least 4,300 end-of-life D-Link routers, primarily DIR-850L and DIR-818LW models, exploiting CVE-2013-3307 and CVE-2016-5681 to install SSH backdoors. Unlike typical DDoS-focused router botnets, AryStinger functions as a persistent reconnaissance and proxy network, enabling threat actors to scan targets and anonymize attack traffic. A second variant observed on April 26 also targets QNAP NAS devices via CVE-2025-11837, a patched code injection flaw in QNAP's Malware Remover application.