In terms of functionality (not impact) the AryStinger campaign uses previously unknown malware to convert millions of old home routers into an unobtrusive distributed reconnaissance proxy network, i.e., not a DDoS botnet. QiAnXin's XLab reports that they have identified at least 4,300 devices as part of this malware campaign and expect that number to continue to rise. This is important. While AryStinger is similar to other campaigns such as 5socks and AnyProxy, which used the Moonlight Trojan to create residential proxy networks by infecting old Linksys and Cisco routers, AryStinger appears to exist strictly for the reconnaissance phase of attacks.
Infected devices will perform a variety of functions including:
- Scan the internet for active hosts;
- Fingerprint services on those hosts;
- Enumerate sub-domains on those hosts;
- Tunnel traffic for attackers to send probes from behind the infected device;
- Run commands entered by the attacker via the infected device;
- Send the output of their work back to the attacker.
Thus each router becomes a footprinting node and a relay for the attacker, obscuring their location.
Old Chips and Old Bugs
The AryStinger malware campaign targets old routers utilizing Realtek's RTL819X chips, old hardware that was common circa 2012 to 2015. XLab reported that it first discovered AryStinger on March 12, 2026, emanating from a single IP address (107.150.106.14).
Once the router became infected with AryStinger, XLab found that it installed a Linux ELF binary that none of the AV engines on VirusTotal detected.
The malware exploited two vulnerabilities that were also old: CVE-2013-3307 (which impacted some Linksys routers) and CVE-2016-5681 (which impacted some D-Link routers).
Most of the devices were D-Link routers, with the DIR-850L being approximately 75% of all the devices infected. Geographically, the majority of the infections were located in South Korea (approximately 48%) and China (approximately 32%). Other top locations included Sweden, Malaysia, and Singapore.
On April 26th, a second variant of AryStinger emerged that targeted QNAP NAS boxes via CVE-2025-11837, a code injection vulnerability in QNAP's Malware Removal Tool. The vulnerability was demonstrated at Pwn2Own Ireland in 2025 and had been patched in November of 2025. However, QNAP did not release the patch until months later when the second variant began using it.
Similar to how attackers initially gained access to D-Link routers, attackers are able to gain access to QNAP NAS devices by using QNAP's own Malware Removal Tool. As such, XLab has not captured infection data for QNAP devices, so the above-mentioned count of 4,300 refers solely to RTL819X routers.
Two Builds, Same Job
There appear to be two builds for AryStinger: one that is relatively lightweight and intended for older hardware, and a second that appears to be fully featured. The lightweight build for routers is written in C and appears to be very basic due to performance constraints imposed by the age of the underlying hardware. As such, this build appears designed primarily for massive DNS scanning and traffic tunneling. The NAS build is written in Go and performs many additional tasks beyond what the router build does. In addition to performing internal and external network scans and executing recon tools like Fscan, KsubDomain, and HttpX, the script work task allows the operator to execute source code on the box (written in Go, Java, or Python), eliminating the need to compile binaries per target.
Each infected node, referred to as an executor by XLab, communicates with its C2 via HTTP/HTTPS, sending data encoded in Protobuf format encrypted via simple XOR (with Gzip added on top for the Go build). Operators divide large scans into chunks and distribute them across their fleet, allowing them to conduct simultaneous footprinting.
As noted by XLab, since scanners can be directed at resolvers as well, the same DNS scanning capability could potentially be leveraged to generate denial-of-service traffic against those resolvers.
Persistence is maintained through a Dropbear SSH server installed on a pre-determined port number (2332 for routers, or gs-netcat for NAS) using a hardcoded key value "sh_#@!_2024_secret". While XLab notes that there is a "2024" value present within the key string that may indicate a potential 2024 start date, XLab cannot confirm this.
A Familiar Model
While AryStinger shares many similarities with past campaigns utilizing old hardware and exploiting N-day vulnerabilities (such as the TheMoon malware campaign of 2009 utilizing vulnerable Linksys/Cisco routers), it bears resemblance to recent operational relay box networks (ORBs) utilized by nation states to use meshed networks of compromised end-of-life routers and IoT devices to scan and relay traffic while remaining difficult to identify or trace. Mandiant has documented several examples of ORBs, including Lapdogs, which utilizes similar methods to recruit compromised devices via N-day vulnerabilities.
At this time, there are no indications as to who is behind AryStinger. XLab continues investigating but acknowledges the model itself is clearly established: forgotten hardware and ancient CVEs equal quiet infrastructure for pre-intrusion reconnaissance activities.
Actions to Take
For users operating any of the aforementioned affected devices (e.g. Linksys, Cisco, D-Link, or QNAP), identifying if your device has become compromised is relatively straightforward. Search for outbound connections to AryStinger's C2 servers and domains (as listed within XLab's IOC list), search your /tmp/bin directory for any executable files not created by yourself, and verify whether you see any processes named syswapd0h or syswapd0w running on your system.
