Back Thehackernews

AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

Thehackernews •[email protected] (The Hacker News) • June 22, 2026

Learn how to uncover hidden AI use, see what data it can access, map every AI action to a human owner, and apply practical governance without heavy infrastructure changes.

Learn how to contain Mythos-style AI attacks with practical Zero Trust controls that reduce exposure, stop lateral movement, and limit risk.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AryStinger Botnet Compromises Over 4,300 D-Link Routers for Reconnaissance The AryStinger botnet has infected more than 4,300 D-Link routers, specifically the DIR-850L and DIR-818LW models, which are no longer supported by the manufacturer. This malware, identified by researchers at Qianxin's XLab, converts compromised devices into reconnaissance tools that can perform scanning and proxying activities. It exploits vulnerabilities including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837. The majority of infections are reported in South Korea, followed by China and other countries. AryStinger's design allows attackers to efficiently conduct reconnaissance on potential targets, increasing the likelihood of successful intrusions. The botnet's activity began shortly after law enforcement disrupted a previous botnet, AVrecon, which targeted the same router models. Users are advised to replace outdated routers and apply security measures to mitigate risks. 9 sources 72

AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

The full story

Extracted Entities

Attack Types (1)

Malware (1)