AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

A new malware family named AryStinger, discovered by QiAnXin’s XLab, has infected at least 4,300 legacy routers to create a distributed reconnaissance and proxy network. Unlike typical DDoS botnets, AryStinger is used for pre-intrusion activities such as scanning the internet, fingerprinting services, enumerating subdomains, tunneling traffic, and executing commands on demand. The campaign targets routers built on Realtek’s RTL819X chips (circa 2012-2015), exploiting two old vulnerabilities: CVE-2013-3307 in Linksys models and CVE-2016-5681 in D-Link models. The majority of infected devices are D-Link DIR-850L routers (about 75%), with infections concentrated in South Korea (48%) and China (32%). A second strain targets QNAP NAS boxes via CVE-2025-11837, a code injection flaw in QNAP’s Malware Remover, demonstrated at Pwn2Own Ireland 2025. The router build is written in C for lightweight operations like DNS scanning and traffic tunneling, while the NAS build is written in Go and includes advanced recon tools (fscan, ksubdomain, httpx) and a ScriptWork task for executing attacker-supplied code. Infected nodes communicate with C2 over HTTP/HTTPS with Protobuf-encoded traffic obfuscated by XOR. Persistence is achieved via Dropbear SSH on port 2332 (routers) or gs-netcat (NAS). The malware resembles operational relay box networks (ORBs) tracked by Mandiant, similar to the 5socks and Anyproxy services dismantled in 2025. Attribution is still under investigation. Users are advised to check for outbound connections to C2 domains (e.g., ajb8.com), look for suspicious binaries in /tmp/bin, and retire end-of-life routers.