Asus Routers Compromised in Major Cybercrime Botnet Operation

• •Over 14,000 Asus routers have been infected by the KadNap malware.
• •The botnet employs a custom Kademlia DHT protocol for enhanced resilience.
• •The cybercrime proxy network, known as Doppelgänger, is actively being used in attacks.

A new strain of malware, dubbed KadNap, has infected over 14,000 Asus routers, forming a botnet that powers a cybercrime proxy network known as Doppelgänger. The botnet utilizes a custom Kademlia Distributed Hash Table (DHT) protocol, enhancing its resilience against takedown efforts. Black Lotus Labs has identified this extensive network, which is actively being exploited in the wild. The malware allows attackers to leverage the compromised routers for various malicious activities, significantly expanding the scope of the cybercrime operation. The ongoing exploitation poses a serious risk to affected users and networks, as the botnet continues to grow. Security experts are urging immediate action to mitigate the risks associated with this malware strain.