AryStinger Botnet Uses Intranet Scanning and Traffic Tunneling to Hide Attacker Activity

A newly analyzed botnet family, AryStinger, weaponizes long‑neglected routers and NAS appliances to build a stealthy reconnaissance and relay infrastructure that helps attackers obscure origin and extend lateral reach.

AryStinger leverages decade‑old vulnerabilities in RTL819X‑based routers and a more feature‑rich Go‑implemented “Standard” branch on NAS devices to perform distributed scanning, intranet discovery, and traffic tunneling turning compromised edge devices into covert stepping stones for espionage and follow‑on attacks.

At core, AryStinger implements a controller/Executor model: each infected device authenticates to C2 servers and receives an Executor ID that uniquely identifies it for subsequent tasking.

Communications use Protobuf serialization with layered compression and simple XOR obfuscation (the family uses a hardcoded key sh_#@!_2024_secret), transported over HTTP/HTTPS.

The RTL819X builds are compact C binaries for constrained routers and support mass DNS and HTTP scanning plus a tunnel module; the Standard variant (Go) targets NAS hosts and broadens capabilities to include multi‑type scanning, script‑level payload execution (Go/Java/Python), and integrated intranet reconnaissance via toolsets such as Fscan and Ksubdomain.

This allows parallelized footprinting while keeping each node’s activity low and less suspicious. ScriptWork notably lets operators push source payloads to execute directly on targets, providing rapid flexibility across platforms but increasing exposure when interpreters or plaintext payloads are written to disk.

QiAnXin XLab’s field of view , specifically targeting router devices based on the RTL819X series chips. AryStinger’s task architecture is modular and distributed. The C2 issues fine‑grained jobs DNS brute force, IP scans, HTTP Alive checks, and ScriptWork tasks which the attacker shards across many Executors.

For persistent control, the malware deploys lightweight backdoors: RTL819X builds download and run dropbear SSH on a fixed port, while Standard builds install gs‑netcat or a nat_tunnel binary to proxy traffic.

The tunnel components appear reused between variants and enable traffic forwarding that masks the attacker’s true location and helps pivot into otherwise isolated networks.

Operational telemetry shows worrying scale and selectivity. QiAnXin’s asset mapping found over 4,300 infected RTL819X routers worldwide heavily concentrated in South Korea and China and primarily affecting D‑Link models with NAS infections also observed but not fully quantified.

Infections spread using publicized flaws such as CVE‑2013‑3307, CVE‑2016‑5681 for routers, and CVE‑2025‑11837 for NAS devices, reflecting an attacker strategy of reviving long‑known exposures to compromise legacy firmware that lacks vendor updates.

The threat model here is threefold: persistent eavesdropping of network traffic, DNS hijacking access or content manipulation at the gateway, and concealment of follow‑on offensive operations.

AryStinger Standard hardcodes two C2 addresses, dybic.ajb8.com and opi7.com , with communication based on the HTTPS protocol.

Because AryStinger encodes and fragments scanning tasks and employs tunnels, defenders face attribution and cleanup challenges: attacks routed through many compromised gateways produce misleading source artifacts and lengthen remediation windows.

Defensive recommendations are immediate and pragmatic. Prioritize replacement or isolation of end‑of‑life routers and NAS devices, patch where vendor fixes exist, and audit edge devices for known IOCs such as the C2 domains and dropbear listening ports referenced in the XLab report.

Network defenders should enable egress filtering, monitor for unusual outbound HTTPS to hardcoded domains, and scan device filesystems (notably /tmp/bin) for dropped toolsets.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

QNAP has issued security advisory QSA-26-10, which addresses 14 vulnerabilities affecting its widely used NAS…

Microsoft has announced a significant update to its Microsoft 365 ecosystem to enhance data protection.…

A malicious npm package, postcss-minify-selector-parser, has been discovered masquerading as a benign PostCSS utility and…

A suspicious file named “GST Debit Note Apr_26.com,” which triggered a deeper investigation and revealed…

Researchers have uncovered a systemic LLM credential exposure problem in the iOS ecosystem, with 282…

The LACUNA Chain's “Ghost Frames” technique introduces a new method for manipulating call stacks that…