D-Link Routers Hijacked by AryStinger Botnet: Over 4,300 Devices Now Scanning for Future Targets

More than 4,300 routers worldwide have been quietly converted into a distributed reconnaissance network by a newly documented malware family called AryStinger — not the familiar kind of botnet that floods websites with traffic, but one specifically engineered to gather intelligence on other networks before attackers strike them. Threat researchers at Qianxin XLab , a Beijing-based security firm, published their technical findings on June 17, and the infection count has continued to climb since then.

Every compromised device is a D-Link router — almost exclusively the DIR-850L and DIR-818LW models, both of which have been out of manufacturer support for years and cannot receive security patches. The same two router models were flagged in a March 12, 2026 FBI FLASH notice warning consumers AVrecon, another botnet that hijacked the same hardware. AryStinger represents a new campaign, a new operator, and a meaningfully different threat: where AVrecon turned routers into residential proxies for ad fraud and banking scams, AryStinger turns them into reconnaissance scouts designed to map and infiltrate other networks.

The DIR-850L first shipped in 2013. D-Link ended firmware support for both models years ago, which means the security vulnerabilities AryStinger exploits will never be patched. That patch gap is not a coincidence — it is the attacker's selection criterion.

AryStinger enters through three documented vulnerabilities. CVE-2013-3307 and CVE-2016-5681 both target D-Link and Linksys router hardware from the 2012–2015 generation. CVE-2025-11837 is a critical flaw in QNAP network-attached storage devices demonstrated at Pwn2Own Ireland 2025 and patched by QNAP — but only on devices whose owners applied the update.

The two D-Link models at the center of AryStinger's campaign were previously compromised by AVrecon, a botnet Lumen Technologies' Black Lotus Labs first documented in July 2023 and disrupted by null-routing the malware's command-and-control servers. Law enforcement followed with Operation Lightning on March 11, 2026, seizing 34 domains and 23 servers tied to SocksEscort — the criminal proxy service that had used AVrecon-infected routers for banking fraud, romance scams, and account takeover attacks. The operation was announced the day before the FBI issued its FLASH notice naming the DIR-850L and DIR-818LW by model number.

AryStinger's operators began spreading the malware one day after that law enforcement action. XLab's Network-wide Threat Awareness System first detected AryStinger activity on March 12, 2026 — the same day as the FBI FLASH notice — when it recorded an infected server pushing a zero-detection malware sample through CVE-2013-3307 and CVE-2016-5681. The botnet then added a Go-based variant targeting NAS devices in April, exploiting CVE-2025-11837.

Most router botnets are blunt instruments — they launch denial-of-service attacks, send spam, or sell access to residential IP addresses. AryStinger was built for something more precise. The XLab researchers describe it as a "reconnaissance and attack cluster" designed for the pre-intrusion phase of a targeted network attack: the stage where an operator maps out a victim network before breaking in.

Each infected router functions as what XLab calls an Executor — a node that receives task assignments from a central command-and-control server and executes them in parallel with hundreds of other infected devices. The C2 server communicates with each bot using Protobuf-encoded messages encrypted with a hardcoded XOR key, then assigns the bot a unique Executor ID for all subsequent communications. A hardcoded key string in the malware — sh_#@!_2024_secret — suggests the operation may have begun as early as 2024, though the earliest confirmed XLab detection is March 2026.

XLab has captured 32 distinct version samples of AryStinger since March 12. The version numbering implies active development. The researchers found two functional variants.

The RTL819X variant — implemented in C, targeting the RTL819X-series chips found in D-Link routers from the 2012–2015 era — supports domain scanning, traffic tunneling, and network proxying. It deploys a copy of Dropbear, a lightweight SSH server, on port 2332 of each compromised router, establishing a persistent remote login backdoor that survives reboots. Once the backdoor is in place, the attacker retains access to the router regardless of what other activity is detected or blocked.

The Standard variant — implemented in Go, targeting NAS devices through CVE-2025-11837 — is more capable. In addition to IP and DNS scanning, it integrates named open-source penetration testing tools: fscan, ksubdomain, httpx, and Tlsx. It supports Shell commands and execution of Go, Java, and Python source code, though XLab notes that running source code rather than compiled binaries introduces noise that can undermine stealth. The NAS variant also performs internal network reconnaissance — mapping systems inside the local network, not just the internet-facing router.

The distributed scan architecture is the key design insight. Rather than conducting network reconnaissance from a single source — which is easily detected and blocked — the operator splits scanning tasks into small chunks and distributes them across hundreds of compromised routers. Each router runs a small portion of the scan. From the perspective of any targeted network, the probing traffic appears to originate from hundreds of different residential IP addresses in multiple countries. XLab also noted that the distributed DNS-scanning infrastructure could be repurposed to generate high-volume DNS queries against resolvers, though no such attacks had been observed at the time of publication.

Beyond its use as a springboard for attacks on others, AryStinger poses a direct threat to the household running the infected router. The malware can modify the router's DNS configuration, silently redirecting every web request made through that router to attacker-controlled servers. This creates a persistent opportunity for credential theft, phishing, and browser session hijacking — not through a virus on a single computer, but at the network level, affecting every phone, laptop, tablet, and smart device connected to the router.

The malware also monitors and can capture all inbound and outbound network traffic. Passwords, financial credentials, session tokens, and private communications transiting through the router are potentially exposed from the moment of infection. Because AryStinger has a near-zero detection rate in mainstream security engines, there is no alert, no popup, and no performance degradation obvious enough to prompt most users to investigate.

Geographic data from QiAnXin's asset-mapping platform shows infections across South Korea (48.5%), China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%). The heavy South Korea concentration may reflect the historical prevalence of these specific D-Link models among that country's ISP customer base, though XLab did not identify a definitive explanation. The count covers only the RTL819X-class router infections. XLab has no visibility into the scale of AryStinger's NAS infections and does not know whether additional device classes beyond routers and NAS systems are being targeted.

For owners of the D-Link DIR-850L or DIR-818LW, one option is available: replace the hardware. D-Link has no patch planned or possible for either model. The company's general policy on end-of-life products states that "when products reach EOS/EOL, they can no longer be supported, and all firmware development for these products ceases." Factory resets and firmware reinstalls address the symptom temporarily but do not close the underlying vulnerabilities that AryStinger and its predecessors exploit.

For QNAP NAS owners, the situation is different: CVE-2025-11837 has been patched in QNAP's Malware Remover application. Owners of QNAP NAS devices should verify they have applied the update that QNAP issued following Pwn2Own Ireland 2025.

XLab recommends that all end-of-life router owners replace devices with actively supported models, change the default administrator password, disable remote management panels if not needed, and apply the latest available firmware to any device still under vendor support. The FBI's March 2026 FLASH notice offered the same guidance and added that rebooting an infected router disrupts some infections but does not prevent reinfection.

AryStinger's operators have not been identified. XLab's researchers noted that the malware's technical origins and behavioral characteristics were sufficient to name and track the malware family, but that "many mysteries surrounding AryStinger remain to be solved." The botnet's design — built for targeted reconnaissance rather than commodity cybercrime — leaves open the question of whether the operator is a financially motivated actor building future attack infrastructure for sale or lease, or a group conducting its own intelligence-gathering operations.

How do I know if my router has been infected with AryStinger?

There are no visible symptoms. AryStinger was designed to operate undetected, and it has a near-zero detection rate in mainstream antivirus and security software. The malware does not slow the router noticeably, does not display error messages, and does not prevent normal internet use. The most reliable indicator is the router model: if you own a D-Link DIR-850L or DIR-818LW, your device is a confirmed high-risk target. If you own either model, replacement is the appropriate response — not a scan or reset.

What is an end-of-life router, and why can't it be patched?

An end-of-life router is a device for which the manufacturer has permanently ceased firmware development and support. For D-Link models like the DIR-850L and DIR-818LW, that means the security vulnerabilities AryStinger exploits — some disclosed more than a decade ago — will never receive a fix. The chip architecture (RTL819X series, produced predominantly from 2012 to 2015) cannot receive new firmware that addresses these flaws. Continuing to use an end-of-life router means accepting that any attacker who targets the device's known vulnerabilities faces no technical barrier.

What can AryStinger do to traffic flowing through my router?

AryStinger gives attackers the ability to modify DNS settings on the infected router, redirecting web traffic from any device on the network to attacker-controlled servers without the user's knowledge. It also monitors and can capture all inbound and outbound network data — including login credentials, session tokens, and financial information. This affects every device connected to the router, not just computers: phones, tablets, smart TVs, and IoT devices all route traffic through the same compromised hardware.

What makes AryStinger different from other router botnets?

Most router botnets are built for volume: they launch distributed denial-of-service attacks, send spam, or sell access to residential IP addresses for use in fraud. AryStinger is designed for reconnaissance — the intelligence-gathering phase that precedes a targeted network intrusion. Each infected router is assigned specific scan tasks by a central server and executes them in parallel with hundreds of other bots, allowing the operator to map networks and probe for vulnerabilities across a broad range of targets while appearing to operate from ordinary household IP addresses across multiple countries.