AryStinger has compromised at least 4,300 legacy routers, primarily D-Link DIR-850L and DIR-818LW devices, using vulnerabilities dating back as far as 2013. Unlike many conventional IoT botnets focused mainly on denial-of-service attacks, AryStinger turns infected devices into distributed reconnaissance, proxy, tunnelling, and command-execution nodes that can support wider intrusion campaigns. 

The discovery of the AryStinger botnet demonstrates how outdated routers can become long-term infrastructure for cybercriminal operations, even when the original vulnerabilities used to compromise them were disclosed more than a decade ago.

Security researchers have identified more than 4,300 infected routers worldwide, with the actual number potentially being higher. The campaign primarily targets legacy D-Link devices based on the RTL819X chipset, particularly the DIR-850L and DIR-818LW models.

Other affected models reportedly include the DIR-816L, DIR-818L, DWR-118, and DIR-817LW, along with certain older Linksys devices and network-attached storage systems.

The highest concentration of identified infections was found in South Korea, followed by China, Sweden, Malaysia, and Singapore.

The campaign exploits several known vulnerabilities, including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837.

The presence of vulnerabilities dating back to 2013 is particularly significant. It shows that attackers do not require newly discovered zero-day flaws when thousands of unsupported devices remain connected to the internet with known weaknesses.

A vulnerability does not become harmless because it is old. It becomes easier to exploit because technical details, proof-of-concept code, automated scanners, and vulnerable-device fingerprints are widely available.

Legacy routers are especially attractive because they often remain in service for many years after manufacturers stop providing firmware updates.

Users may continue operating them because the internet connection still works, the device appears stable, and replacing it seems unnecessary.

Unfortunately, “still functioning” and “still secure” are entirely different conditions, despite being routinely treated as synonyms in technology procurement.

AryStinger is not designed only to generate large volumes of denial-of-service traffic. Its architecture suggests a broader role as distributed infrastructure for reconnaissance and future intrusions.

Each compromised device operates as an executor controlled by the attacker.

Large scanning operations can be divided into smaller tasks and distributed across thousands of infected routers. Each router performs part of the scanning activity and returns the results to the command-and-control system.

This distributed approach helps attackers identify internet-facing systems, open ports, active services, subdomains, TLS configurations, and potential vulnerabilities across large target ranges.

The scanning appears to originate from residential or small-business internet connections rather than a small number of known malicious servers.

This makes the activity more difficult to block using simple IP reputation controls.

An organization may see what appears to be a minor scan from an ordinary consumer broadband address. In reality, that scan may be one small part of a coordinated reconnaissance operation involving thousands of compromised routers.

The attacker can therefore hide behind legitimate customer connections while distributing activity broadly enough to avoid obvious volume-based detection.

AryStinger also provides proxying and tunnelling capabilities.

A compromised router can relay attacker traffic toward another target, concealing the operator’s true location and infrastructure.

This can be used to conduct password attacks, vulnerability scanning, exploitation attempts, fraud, phishing, or unauthorized access through an IP address that appears to belong to an ordinary household or business.

Residential proxy infrastructure is highly valuable to cybercriminals because many security systems trust or assign lower risk to traffic originating from consumer internet providers.

Traffic from compromised routers may be less likely to be blocked than traffic from cloud hosting providers, virtual private networks, or previously identified malicious servers.

The owner of the router may remain unaware that their internet connection is being used to attack other organizations.

They may experience slower connectivity, unusual bandwidth consumption, unstable DNS behaviour, or unexplained service interruptions without understanding the underlying cause.

They may also receive complaints, blocklist listings, abuse notices, or law-enforcement attention because malicious activity appears to originate from their public IP address.

The router effectively becomes both a victim and an unwilling participant in further attacks.

AryStinger can also alter DNS settings on compromised devices.

DNS determines how domain names are translated into network addresses. If attackers control the DNS configuration, they may redirect users away from legitimate websites and toward malicious destinations.

A user attempting to visit a banking, email, cloud, shopping, or software-download website could be directed to an attacker-controlled page.

The fraudulent site may look almost identical to the legitimate service and may be used to steal usernames, passwords, payment information, or multifactor authentication codes.

DNS manipulation can also redirect software updates, inject advertising, distribute malware, or block access to security services.

This type of attack is especially dangerous because every device using the compromised router may be affected.

The user’s laptop, phone, tablet, smart television, security camera, printer, and other connected devices may all rely on the router’s DNS settings.

Individual endpoints may be fully patched and still be directed toward malicious services because the compromise exists at the network gateway.

Attackers may also monitor or relay traffic passing through the compromised router.

Encrypted HTTPS connections provide important protection against direct content inspection, but attackers may still observe destination addresses, timing, connection patterns, DNS requests, and other metadata.

Unencrypted traffic may be read or modified more directly.

The ability to monitor traffic can expose internal service names, user behaviour, software-update activity, remote-access connections, and other information useful for later attacks.

For small businesses, a compromised router may expose far more than internet browsing.

The same device may provide wireless connectivity, VPN access, network address translation, guest networking, port forwarding, DNS, DHCP, and connectivity between employee devices and internal systems.

Control over the router may allow an attacker to explore the internal network, identify connected systems, and search for weak services.

The more advanced AryStinger variant targeting network-attached storage systems includes internal network reconnaissance capabilities.

It incorporates open-source penetration-testing and scanning tools that can identify devices, services, vulnerabilities, domains, and network configuration.

The malware reportedly supports IP scanning, DNS scanning, HTTP service detection, domain enumeration, TLS inspection, command execution, and internal network discovery.

It can collect system information, process details, network configuration, and vulnerability information from the compromised environment.

The results are sent back to the attacker, who can use them to design a more targeted intrusion.

This turns the infected device into a reconnaissance platform positioned inside the victim’s network.

An external attacker normally sees only internet-facing services. Once a router or NAS device is compromised, the attacker may gain visibility into systems that were never intended to be reachable from the internet.

These could include workstations, printers, file servers, cameras, industrial devices, administrative panels, or poorly secured internal applications.

The botnet therefore creates a bridge between external threat actors and internal network resources.

The standard AryStinger variant also supports remote command execution.

Attackers can issue shell commands and attempt to execute payloads written in Go, Java, or Python.

This provides operational flexibility because the attackers can deploy different tools according to the target environment.

The use of source-code payloads has limitations because the required language runtime must be present on the compromised system. It may also leave more visible traces in process logs and on disk.

Nevertheless, the capability shows that AryStinger is not limited to one fixed function.

The botnet can be adapted for reconnaissance, persistence, lateral movement, proxying, or delivery of additional malware.

The router-focused version is written in C and optimized for older devices with limited memory and processing power.

It performs a narrower set of functions, mainly large-scale scanning and traffic tunnelling.

This division illustrates how attackers tailor malware according to the capabilities of the target device.

An old router may not be powerful enough to run advanced toolsets, but it can still provide a reliable public IP address, network visibility, and an always-on connection.

Thousands of such devices operating together provide significant capability.

The malware communicates with command-and-control servers using HTTP or HTTPS.

Its messages are serialized using Protocol Buffers and protected with compression, XOR-based obfuscation, or both, depending on the variant.

After infection, the device authenticates with the command-and-control server and receives a unique identifier.

It then sends periodic heartbeat messages, retrieves configuration updates, and waits for tasks.

The malware also includes watchdog and update functions designed to keep the bot operational.

This suggests that the operators are actively maintaining the infrastructure rather than deploying a one-time proof of concept.

Researchers captured dozens of different AryStinger versions over a relatively short period, indicating ongoing development and deployment.

The campaign’s low detection rate is another concern.

Routers and embedded devices often lack endpoint detection, antivirus, application control, or detailed logging.

Even when malware is running, users may have no simple method to inspect processes, files, or outbound communication.

Consumer and small-business routers are frequently excluded from centralized security monitoring.

Organizations may invest heavily in protecting laptops, servers, cloud platforms, and email while treating the network gateway as an appliance that requires attention only when the internet stops working.

This creates an attractive blind spot.

A compromised router may remain active for months or years because it continues routing traffic normally.

The malware does not need to create obvious disruption. Remaining quiet preserves the value of the infected device as a proxy and reconnaissance node.

The campaign also demonstrates the danger of end-of-life equipment.

When a manufacturer declares a product unsupported, newly discovered vulnerabilities may never receive patches.

Even previously released updates may no longer be easily available, tested, or deployed.

Resetting an unsupported router or changing its password does not correct a remotely exploitable firmware vulnerability.

The device may be compromised again shortly after being returned to service.

For affected D-Link models that no longer receive security support, replacement is the only reliable long-term solution.

Owners should migrate to a currently supported router that receives regular firmware and security updates.

Organizations should not purchase used or refurbished network devices without verifying their support status.

An inexpensive legacy router may appear financially attractive but can introduce permanent exposure that cannot be remediated through ordinary patching.

Procurement teams should check the manufacturer’s end-of-life date, update policy, hardware revision, and expected support period before acquiring network equipment.

Support lifecycle should be treated as a security requirement, not merely a warranty detail.

Organizations should maintain an inventory of every router, wireless access point, VPN gateway, modem, firewall, and NAS device connected to their networks.

The inventory should include the manufacturer, model, hardware revision, firmware version, management address, location, business owner, internet exposure, and support status.

Devices that cannot be identified or are no longer supported should receive immediate review.

Branch offices, remote sites, temporary locations, employee home offices, retail outlets, and acquired businesses are particularly likely to contain forgotten network equipment.

A centrally managed enterprise firewall does not protect a branch whose internet connection still passes through an unsupported consumer router.

Remote workers may also connect corporate devices through vulnerable home gateways.

The organization cannot always control personal routers, but it can establish minimum security requirements for high-risk remote access.

Employees handling sensitive data may need company-managed networking equipment or stronger device-level controls.

Current firmware should be installed on every supported router.

Administrators should verify the actual firmware version through the device interface rather than assuming that automatic updates are enabled and functioning.

Some devices require manual firmware installation, while others stop receiving updates silently after reaching end of support.

Firmware should only be downloaded from the manufacturer or another verified source.

Default administrative passwords must be changed.

The password should be long, unique, and not reused for Wi-Fi, email, cloud, or other devices.

Administrative accounts should not use common usernames and predictable passwords where the device allows customization.

Remote management from the internet should be disabled unless there is a documented operational requirement.

Administrative interfaces should only be accessible from trusted internal networks, VPN connections, or specific management systems.

Universal Plug and Play should also be disabled where it is not required.

UPnP can allow applications and devices to create port-forwarding rules automatically, sometimes exposing internal services without the user realizing it.

Organizations should review existing port-forwarding rules and remove any that are no longer necessary.

Telnet, insecure HTTP management, outdated VPN protocols, and other legacy services should be disabled.

Administrative access should use HTTPS or SSH with appropriate cryptographic settings.

Guest wireless networks should be separated from internal business systems.

Internet-of-Things devices, cameras, entertainment systems, and personal devices should not share unrestricted network access with corporate endpoints and servers.

Network segmentation reduces the damage possible if one device or gateway becomes compromised.

Routers should use trusted DNS resolvers, and administrators should regularly verify that DNS settings have not changed unexpectedly.

Unauthorized DNS addresses are a common indicator of router compromise.

Users experiencing redirects, certificate warnings, unusual advertising, or unexpected login pages should not simply assume that the website is malfunctioning.

The router and DNS configuration should be investigated.

Security teams can monitor outbound DNS traffic and identify devices communicating with unauthorized resolvers.

Organizations may enforce approved DNS services through firewall policy and block direct external DNS requests from ordinary endpoints.

Encrypted DNS protocols should also be governed so that compromised devices cannot bypass monitoring by selecting arbitrary external resolvers.

Network teams should inspect logs for communication with known AryStinger command-and-control and downloader infrastructure.

Unexpected connections from routers or NAS systems to unfamiliar domains should receive immediate attention.

Routers generally communicate with a relatively small set of services, such as update servers, time servers, DNS resolvers, and management platforms.

Connections to unrelated hosting domains or frequently changing infrastructure may indicate compromise.

Researchers identified suspicious processes named syswapd0h and syswapd0w on infected devices.

They also observed malware and supporting files in the /tmp/bin directory.

Administrators with appropriate access should check affected devices for these indicators.

However, the absence of known filenames does not prove that the device is clean. Attackers can rename files, update malware, or use variants that leave different traces.

A factory reset may temporarily remove malware stored in volatile directories, but it does not patch the exploited vulnerability.

If the device remains internet-accessible and unsupported, reinfection may occur quickly.

Where an end-of-life router is suspected of compromise, it should be disconnected and replaced rather than reset and returned to service indefinitely.

Before replacing the device, organizations should preserve relevant logs and configuration information where an investigation is required.

The current configuration should not be copied blindly to the new router.

Malicious DNS settings, port forwards, administrator accounts, or remote-management rules may be reproduced if the old configuration is restored without review.

The replacement should be configured from a known-good baseline.

All credentials previously stored or used on the compromised router should be changed.

This may include administrative passwords, PPPoE credentials, VPN secrets, wireless passwords, dynamic DNS credentials, cloud-management accounts, certificates, and API tokens.

Credential changes should be performed from a trusted system after the compromised device has been removed.

Organizations should review internal systems for signs of reconnaissance or lateral movement.

The router may have been used to scan local devices, access management interfaces, or identify vulnerable services.

Firewall, endpoint, server, DNS, identity, and authentication logs should be examined for unusual activity originating from the router or nearby internal addresses.

Unexpected login attempts against servers, NAS devices, cameras, printers, and administrative interfaces may indicate that the compromise extended beyond the gateway.

Connected systems should be patched and protected with unique credentials.

Network devices must not all share the same administrator password.

One compromised router should not provide credentials that also unlock every switch, access point, camera, and storage appliance.

Enterprises should also monitor for unusual scanning patterns originating from their public IP addresses.

Large numbers of outbound connections to diverse destinations and ports may indicate that an internal or gateway device is participating in reconnaissance.

Bandwidth monitoring, flow records, DNS logs, and firewall telemetry can help identify this behaviour.

Internet service providers can play an important role by detecting infected customer equipment and notifying subscribers.

They may observe scanning, proxy traffic, or command-and-control communication that individual users cannot see.

However, customer notification must include clear remediation guidance. Advising a user to reboot an unsupported router does little when the device can be compromised again moments later.

Manufacturers should provide transparent end-of-life notices and make support status easy to determine.

Consumers should not need to search obscure support pages to learn that a device protecting their entire network stopped receiving updates years earlier.

Internet providers and retailers should also avoid distributing or selling unsupported equipment.

The continued resale of end-of-life routers extends the useful life of the botnet far more effectively than it extends the safe life of the product.

The incident provides a broader lesson for enterprises about infrastructure debt.

Old networking equipment often remains operational because replacement creates cost, downtime, and administrative work.

The risk remains invisible until attackers begin exploiting it.

Deferred replacement may reduce expenditure in one financial period while accumulating security exposure across several years.

Lifecycle management should therefore include planned retirement dates and replacement budgets.

Security teams should identify products approaching end of support before updates stop, not after active exploitation begins.

Compensating controls can reduce risk temporarily but cannot provide permanent protection for vulnerable firmware.

AryStinger also shows why security monitoring should include network infrastructure, embedded devices, and appliances.

Endpoint-focused programmes may miss attacks that occur below or around the operating system.

Routers, switches, NAS systems, cameras, and other devices should forward logs where possible and should be monitored for configuration changes, unusual outbound connections, unauthorized services, and firmware integrity.

Network detection and response can identify suspicious scanning, tunnelling, DNS manipulation, and command-and-control traffic even when no endpoint agent can run on the affected device.

Intrusion-prevention systems can block known exploitation attempts against legacy routers, but such protection should be considered temporary.

A perimeter control cannot always protect a router that is itself the perimeter, particularly when its management or vulnerable services are directly reachable from the internet.

For customers, the central lesson is that network gateways must be treated as security-critical computing platforms, not passive appliances.

They run operating systems, web services, DNS components, VPN functions, update mechanisms, and administrative applications. Each of these components can contain exploitable weaknesses.

A router compromised by AryStinger may quietly scan the internet, relay attacker traffic, manipulate DNS, inspect network activity, and provide access to internal systems.

The device may continue delivering internet connectivity throughout the compromise, giving the owner little reason to suspect a problem.

Organizations and individuals using affected or unsupported D-Link models should replace them immediately, update all supported equipment, disable public management, change credentials, verify DNS settings, and investigate suspicious network activity.

The wider lesson is painfully familiar: attackers are not keeping obsolete routers alive out of nostalgia.

They are keeping them alive because unsupported devices provide inexpensive, distributed, and difficult-to-trace infrastructure.

A router that has not received a security update in years should not be trusted simply because its lights still blink and websites still load.

In the AryStinger campaign, those blinking lights may indicate that the device is working perfectly, just no longer exclusively for its owner. 

A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated routers to turn them into proxies for malicious traffic. [...]

Source: AryStinger botnet infected thousands of D-Link routers worldwide via Bleeping Computer — published 21 Jun 2026.