Home / Technology / Routers Hacked: AryStinger Creates Secret Network
Routers Hacked: AryStinger Creates Secret Network
22 Jun
Summary
- AryStinger malware exploits old router flaws for reconnaissance.
- Over 4,300 routers infected, mainly in South Korea and China.
- QNAP NAS devices also targeted through a separate vulnerability.
Cybersecurity researchers have uncovered a widespread campaign leveraging outdated routers and NAS devices to build a distributed reconnaissance and proxy network. The malware, dubbed AryStinger, exploits long-standing vulnerabilities in D-Link and Linksys routers, including CVE-2013-3307 and CVE-2016-5681. These vulnerabilities, affecting devices primarily manufactured between 2012 and 2015, have led to the infection of over 4,300 routers so far.
The majority of compromised routers are located in South Korea (48%) and China (32%), with other affected countries including Sweden, Malaysia, and Singapore. AryStinger allows infected devices to perform internet scanning, service fingerprinting, and covert command execution, effectively acting as a hidden listening device and attack springboard within compromised networks.
In addition to routers, the campaign is also targeting QNAP NAS devices. This is achieved by exploiting CVE-2025-11837, a code injection flaw within the device's Malware Remover, which was patched in November 2025. While the exact number of infected NAS devices remains unknown, the 4,300 figure specifically pertains to routers. Researchers recommend monitoring system logs, checking for unrecognized binaries in /tmp/bin, and identifying suspicious processes like syswapd0h or syswapd0w to detect and mitigate this threat.
