AryStinger hijacks outdated routers via old flaws, turning 4,300+ devices into a stealth network for reconnaissance and intrusion support.

On March 12, 2026, QiAnXin’s XLab threat detection system flagged a single IP address, 107.150.106.14, spreading a Linux binary through two vulnerabilities that were disclosed in 2013 and 2016 respectively. The binary had zero detections on VirusTotal. The devices it targeted were routers built on Realtek’s RTL819X chips, hardware that was mainstream between 2012 and 2015 and has received no firmware updates since. XLab named the malware family AryStinger, based on a source code path hint that the project is called Ary-Attack.

The first thing that sets AryStinger apart is what it doesn’t do. It doesn’t encrypt files. It doesn’t mine cryptocurrency.

“Let’s turn the clock back to March 12, 2026, when the XLab Network-wide Threat Awareness System detected IP 107.150.106.14 spreading a VT 0-detection ELF sample implemented in C through the old vulnerabilities CVE-2013-3307 and CVE-2016-5681″ reads the report published by XLab. “Unlike the common practice of exploiting IoT device vulnerabilities to build DDoS or mining botnets, this campaign aims to build an infrastructure cluster for intrusion reconnaissance activities, possessing information-gathering capabilities such as port scanning, service identification, and subdomain enumeration.”

Each infected router becomes what XLab calls an Executor: a node that receives scan tasks, executes them in parallel with other nodes, and ships the results back to the operator, while hiding the attacker’s real location behind a relay layer.

The infection base currently sits at over 4,300 routers worldwide, a figure XLab says is still rising. It covers only RTL819X devices; the NAS infection scale has no measurement yet. The infected pool is dominated by D-Link hardware, with the DIR-850L accounting for roughly 75% of identified devices. By country, South Korea leads at 48%, followed by China at 32%, then Sweden, Malaysia, and Singapore. None of these are countries that stopped manufacturing security tools. They’re just countries with a lot of old routers that nobody replaced.

The researchers found two separate builds of AryStinger. The RTL819X version is written in C and deliberately stripped down, because the old hardware simply can’t run more. It focuses on mass DNS scanning and traffic tunneling, communicates with its C2 over HTTP using Protobuf-encoded traffic obfuscated with XOR encryption using the hardcoded key sh_#@!_2024_secret, and establishes persistence by downloading Dropbear SSH and running it on port 2332.

A second build, written in Go, appeared on April 26 targeting NAS devices through CVE-2025-11837, a code injection vulnerability in QNAP’s Malware Remover that was demonstrated at Pwn2Own Ireland 2025 and patched in November 2025. Whoever is running AryStinger was exploiting it within five months of the patch. That’s a shorter window than most enterprise patch cycles.

The Go build is considerably more capable. It integrates fscan for internal network scanning, ksubdomain and httpx for subdomain and web service reconnaissance, and Tlsx for TLS fingerprinting. Its most flexible feature is ScriptWork, which executes attacker-supplied source code directly on the infected device.

“ScriptWork supports executing Shell commands as well as source-level Payloads in three categories: Go, Java, and Python.” continues the report. “This design greatly enhances the attacker’s operational flexibility: there is no need to compile binary files separately for different platforms, nor to care about the specific architecture of the target device—it only needs to directly issue the source code to dynamically execute it.”

The downside for the attacker is that source code drops to disk in plaintext and interpreter command lines appear in audit logs, making it more detectable than in-memory binary execution.

The distributed task architecture is the operationally clever part.

“The attacker can split a massive scanning task into multiple small chunks and distribute them to different Executors for parallel execution.” continues the report. “With this distributed-like design, the attacker can efficiently complete the early “footprinting” activities, thereby providing strong assurance for the smoothness and success rate of subsequent intrusion operations.”

XLab confirmed this by running a test device and watching the C2 assign a .ba top-level domain brute-force task with an offset value of 11,654,000,000, placing that specific node at roughly 12% into the length-7 subdomain scanning space. The fleet collectively covers the entire space without any single node doing more than its assigned slice.

The hardcoded key sh_#@!_2024_secret contains “2024,” which may indicate the operation started before XLab’s March 2026 detection. That’s a detail that matters: if the infrastructure has been running since 2024, the reconnaissance data it has already collected could be substantial. XLab hasn’t attributed AryStinger to any known threat actor and says the investigation is ongoing.

“Although many mysteries surrounding AryStinger remain to be solved, the mere fact of its targeted attacks against old routers is enough to define it as a real threat not to be underestimated.” continues the report.

“As a key device for daily internet access, once a router is illegally compromised, it will not only threaten personal privacy and property security, but may even endanger national security.” the Ministry of State Security warned. 

The operational pattern, end-of-life routers compromised through n-day vulnerabilities and turned into relay infrastructure for the pre-intrusion phase, matches what Mandiant and others have documented as Operational Relay Box networks, or ORBs, used by state-linked actors.

“Even more concerning is that this malicious sample and its associated C2 servers have an extremely low detection rate in mainstream security engines.” states the report. “It is precisely in view of the compounded risk of this “low detection rate” and “high potential harm” that we decided to write this article and share our research findings with the security community, in the hope of jointly addressing potential risks and safeguarding overall network security.”

Whether AryStinger is state-sponsored or criminal infrastructure being sold as initial access capability, the model is the same: forgotten hardware, ancient CVEs, quiet and hard to detect.

The remediation guidance is straightforward. Check for outbound connections to AryStinger’s C2 and download infrastructure, primarily ajb8.com, dataexplore.cc, and dataexplore.co hostnames. Check /tmp/bin for binaries you didn’t put there. Look for processes named syswapd0h or syswapd0w. The lasting fix is the one that never gets implemented fast enough: retire hardware that stopped receiving firmware updates years ago. A router running code from 2015 is not a network security device. It’s a vulnerability with an ethernet port.

“Once compromised by malware like AryStinger that possesses reconnaissance and covert control capabilities, it is equivalent to a hacker placing a permanent “invisible listening device” and “attack springboard” within your network.” concludes the report. “There is no doubt that when a large number of old devices are gradually compromised and aggregated, ultimately forming a massive covert botnet, this will pose a continuous, covert, and highly destructive real threat to personal privacy, enterprise security, and even national critical network infrastructure.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

---

---