AryStinger turns old routers into stealth proxies

AryStinger, a newly analysed botnet family, has compromised more than 4,000 outdated routers and begun turning ageing network devices into covert infrastructure for reconnaissance, intranet scanning and traffic tunnelling.

The campaign highlights a shift in botnet use from crude denial-of-service activity towards stealthier pre-intrusion work, where hijacked routers and network-attached storage appliances act as relay points between attackers and intended targets. Security analysts say the malware helps operators conceal their true location, distribute scanning tasks across many infected nodes and extend their reach inside poorly defended networks.

The botnet is built around two branches. A C-based version targets legacy routers using long-known vulnerabilities, while a more capable Go-based “Standard” branch has been observed on NAS devices. The router-focused variant has been linked to devices built around RTL819X-series chips, a hardware generation widely used between 2012 and 2015, leaving many units outside normal support cycles and unlikely to receive fresh security patches.

The affected devices include older D-Link models such as DIR-850L and DIR-818LW, along with other routers exposed to vulnerabilities including CVE-2013-3307 and CVE-2016-5681. A NAS-targeting sample has also been associated with CVE-2025-11837. The age of some flaws underlines the persistence of security debt in home and small-office networking equipment, where devices can remain connected for years after vendor support ends.

Telemetry examined by threat researchers indicates the infection base is concentrated in East and Southeast Asia, with South Korea accounting for nearly half of observed infections and China for close to one-third. Smaller shares have been identified in Sweden, Malaysia and Singapore. The geographic pattern does not necessarily show attacker origin, but it does point to clusters of exposed equipment that can be repurposed as proxy infrastructure.

AryStinger’s infected machines are referred to as “executors”, reflecting their role in carrying out instructions issued by command-and-control servers. Once active, a node can perform internal and external scanning, identify services, execute system commands, forward traffic and assist in tunnelling. The botnet can split large scanning jobs into smaller units and distribute them among compromised devices, allowing attackers to gather information at scale while reducing the visibility of any single node.

The Go-based NAS branch appears more advanced. It includes capabilities for IP and DNS scanning, command execution and payload handling in Go, Java and Python. It also integrates open-source reconnaissance and penetration-testing utilities, a pattern that has become common in intrusion campaigns because attackers can blend legitimate tools with malicious workflows and reduce the need for custom malware at every stage.

The most serious risk lies in what AryStinger enables before a visible breach occurs. By mapping exposed services, probing intranets and relaying traffic through trusted-looking residential or small-business devices, attackers can prepare later operations while making attribution and blocking more difficult. Compromised routers also sit at a sensitive position in the network path, raising the risk of DNS tampering, browsing hijacking and silent monitoring of inbound and outbound traffic.

The campaign fits a broader trend in which routers, firewalls, cameras and NAS systems have become attractive assets for both criminal operators and state-linked groups. Such devices often run lightweight Linux-based systems, face the public internet, receive less monitoring than servers or laptops and are protected by weak passwords or outdated firmware. Once compromised, they can serve as proxy nodes, staging points, data-transfer relays or launchpads for additional intrusion activity.

Botnets built from edge devices have drawn growing attention since several operations showed how residential and small-office equipment can be used to mask espionage, credential theft and scanning activity. The value of such infrastructure lies not only in scale, but in deniability: traffic routed through a consumer router or small business gateway can appear less suspicious than traffic from a known hosting provider or rented virtual server.

Mitigation is difficult where devices are obsolete. Firmware updates remain the first defence where vendors still provide them, but end-of-life equipment often requires replacement rather than patching. Administrators and users are being urged to disable remote management, change default credentials, restrict exposed services, monitor unusual DNS or outbound connections and remove unsupported routers from production networks.

For enterprises, the discovery reinforces the need to treat branch routers, NAS appliances and unmanaged edge devices as part of the attack surface rather than background infrastructure. Asset inventories, network segmentation and anomaly detection can help identify compromised devices before they become footholds for deeper intrusion.

AryStinger’s scale is modest compared with the largest IoT botnets, but its design makes it significant. Its emphasis on scanning, relay and tunnelling shows how attackers are using neglected hardware not merely to create noise, but to build quieter infrastructure for the early stages of cyber operations.