Back Securityaffairs.Co

4,300+ Outdated Routers Hijacked in Stealthy Spy Infrastructure by AryStinger malware

Securityaffairs.Co •Pierluigi Paganini • June 22, 2026

AryStinger hijacks outdated routers via old flaws, turning 4,300+ devices into a stealth network for reconnaissance and intrusion support. On March 12, 2026, QiAnXin’s XLab threat detection system flagged a single IP address, 107.150.106.14, spreading a Linux binary through two vulnerabilities that were disclosed in 2013 and 2016 respectively. The binary had zero detections on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AryStinger Botnet Compromises Over 4,300 D-Link Routers for Reconnaissance The AryStinger botnet has infected more than 4,300 D-Link routers, specifically the DIR-850L and DIR-818LW models, which are no longer supported by the manufacturer. This malware, identified by researchers at Qianxin's XLab, converts compromised devices into reconnaissance tools that can perform scanning and proxying activities. It exploits vulnerabilities including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837. The majority of infections are reported in South Korea, followed by China and other countries. AryStinger's design allows attackers to efficiently conduct reconnaissance on potential targets, increasing the likelihood of successful intrusions. The botnet's activity began shortly after law enforcement disrupted a previous botnet, AVrecon, which targeted the same router models. Users are advised to replace outdated routers and apply security measures to mitigate risks. 9 sources 72

Extracted Entities

4,300+ Outdated Routers Hijacked in Stealthy Spy Infrastructure by AryStinger malware

The full story

Extracted Entities

Attack Types (1)

IP Addresses (1)

Malware (1)

Platforms (1)