AryStinger Botnet Reportedly Compromises More Than 4,000 Routers
Summary
XLab reports that AryStinger has compromised more than 4,000 outdated routers, mainly D-Link models, and some NAS systems. The botnet supports scanning, proxying, DNS tampering and network monitoring; researchers have not linked it to a known actor.
Key points
- XLab reports more than 4,000 infections, concentrated in South Korea and China.
- AryStinger targets older D-Link DIR-850L and DIR-818LW routers by exploiting CVE-2013-3307, CVE-2016-5681 and CVE-2025-11837.
- The botnet uses compromised devices for distributed scanning, proxying, tunneling and command execution.
- Researchers identified a C-based variant targeting routers and a more capable Go-based variant focused on NAS systems.
- The malware can tamper with DNS settings and monitor network traffic; XLab says it did not observe the infrastructure being used for DNS attacks.
- XLab has not attributed AryStinger to a known activity cluster and recommends replacing end-of-life routers, updating firmware, changing default passwords and disabling remote management.
Article Details
- Event Type
- Botnet compromise of outdated routers and NAS systems
- Impact
- AryStinger has compromised more than 4,000 devices, primarily older D-Link routers, turning them into remotely controlled proxies and scanning executors. It can also tamper with DNS settings and monitor network traffic, which could enable browsing hijacking and potential theft of traffic. Researchers have not linked the botnet to a known threat actor. They reported that its distributed DNS-scanning infrastructure could be repurposed for large-scale queries against resolvers, but did not observe such attacks.
MITRE ATT&CK
T1046 · Network Service DiscoveryThe botnet uses infected devices for distributed scanning and network reconnaissance.T1059 · Command and Scripting InterpreterThe NAS variant supports execution of shell commands and source code.T1090 · ProxyAryStinger uses compromised devices as proxies for malicious traffic.
CVE
CVE-2013-3307Linksys · E1000; Linksys · E1200; +1 moreAryStinger exploits older flaws such as CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, targeting primarily D-Link DIR-850L, D-Link DIR-818LW routers.CVE-2016-5681D-link · Dir-817l(w) firmware; D-link · Dir-818l(w) firmware; +8 moreAryStinger exploits older flaws such as CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, targeting primarily D-Link DIR-850L, D-Link DIR-818LW routers.CVE-2025-11837Qnap · Malware removerAryStinger exploits older flaws such as CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, targeting primarily D-Link DIR-850L, D-Link DIR-818LW routers.
Malware
Vendors
Products
Countries
ChinaIt targets older D-Link routers and some NAS systems, with infections concentrated in South Korea and China, while researchers have not yet linked it to a known threat actor.MalaysiaQianxin’s telemetry data shows that almost half of all infections are located in South Korea (48.5%), followed by China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%).SingaporeQianxin’s telemetry data shows that almost half of all infections are located in South Korea (48.5%), followed by China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%).South KoreaIt targets older D-Link routers and some NAS systems, with infections concentrated in South Korea and China, while researchers have not yet linked it to a known threat actor.SwedenQianxin’s telemetry data shows that almost half of all infections are located in South Korea (48.5%), followed by China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%).