AryStinger botnet hijacks 4,000 D-Link routers globally

A previously unknown malware operation, dubbed AryStinger, has compromised over 4,000 end-of-life D-Link routers worldwide, repurposing them as proxies for cybercriminal activities. The botnet, uncovered by Qianxin’s XLab threat intelligence team, leverages outdated firmware vulnerabilities to execute distributed scanning, command execution, and network traffic interception on behalf of attackers. Its modular design allows threat actors to split large-scale reconnaissance tasks across infected devices, accelerating the early stages of intrusion campaigns.

The malware primarily targets two D-Link models: the DIR-850L and DIR-818LW, both of which were previously exploited by the AVrecon botnet in 2023. AryStinger’s infrastructure enables attackers to distribute scanning workloads across compromised routers, reducing detection risks while improving the efficiency of footprinting operations. Beyond scanning, the malware can alter DNS settings, hijack user browsing sessions, and monitor all inbound and outbound traffic, posing significant risks to both home and small business networks.

Geographic spread and technical variants

XLab’s telemetry data reveals that nearly half of all infections are concentrated in South Korea (48.5%), followed by China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%). The botnet exists in two distinct variants: a C-based version focused on routers and a more advanced Go-based variant targeting network-attached storage (NAS) systems. While the NAS variant remains less widespread, it incorporates open-source penetration testing tools for internal network reconnaissance, command execution, and payload delivery in multiple programming languages, including Go, Java, and Python.

Risks and mitigation

The distributed nature of AryStinger’s scanning infrastructure raises concerns about its potential use in large-scale DNS query floods, though XLab has not observed such attacks to date. The NAS variant’s ability to execute arbitrary code—including shell commands and interpreted scripts—further complicates detection, as it relies on language runtimes that may already exist on compromised hosts. However, the compilation process introduces operational noise, which could aid defenders in identifying malicious activity.

XLab researchers have not attributed AryStinger to any known threat actor, leaving its origins and long-term objectives unclear. For affected users, the recommended course of action is to replace end-of-life routers with supported models or, at minimum, apply the latest available firmware updates. Additional precautions include changing default administrator passwords and disabling remote management interfaces to reduce exposure to future exploits.

What to watch

The emergence of AryStinger highlights the persistent risks posed by unmanaged network devices, particularly in regions with high concentrations of outdated hardware. If the botnet’s operators expand its capabilities to include DNS amplification or other volumetric attacks, the impact could extend beyond individual infections to broader internet infrastructure. Defenders should track updates from XLab and other threat intelligence providers for signs of evolving tactics or new target vectors.