AryStinger: a reconnaissance-and-proxy botnet built on end-of-life D-Link routers and QNAP NAS

QiAnXin XLab disclosed AryStinger, a previously-undocumented botnet its telemetry first observed on 2026-03-12, with English-language follow-up reporting on 2026-06-21 (QiAnXin XLab, 2026-06-17; BleepingComputer, 2026-06-21). Unlike the DDoS- and cryptomining-oriented router botnets that dominate this device class, AryStinger's design centre is pre-intrusion reconnaissance and traffic laundering: infected nodes are enrolled as "Executors" and handed distributed scanning and DNS-brute-force tasks by a C2 controller, and they relay the operator's attack traffic so its true origin is hidden. XLab counts at least 4,300 infected nodes and rising, distributed South Korea 48.5%, China 31.8%, Sweden 6.4%, Malaysia 3.5%, Singapore 2.5%; detection rate on public multi-engine scanning was zero at disclosure.

Initial access — three public CVEs across two device classes. The router variant spreads through CVE-2013-3307 (command injection in Linksys/D-Link models built on the Realtek RTL819X SoC family) and CVE-2016-5681 (a stack-based buffer overflow in the D-Link DIR-850L HTTP service) — both unauthenticated RCE on devices manufactured 2012–2015. From 2026-04-26 a second, NAS-targeting variant began exploiting CVE-2025-11837, a code-injection flaw in QNAP's Malware Remover utility (fixed in build 6.6.8.20251023; QNAP's advisory scopes the affected product to the 6.6.x line — update to the latest build). Mapped to T1190 Exploit Public-Facing Application (T1190). The most infected models — D-Link DIR-850L (75% of nodes) and DIR-818LW (13%) — are end-of-life with no firmware fix (D-Link support bulletin SAP10503), so for the router population there is no patch and replacement is the only remediation.

Post-exploitation and persistence. After exploitation a downloader pulls the current payload from C2, the bot authenticates with a unique Executor ID, and a Dropbear SSH server is deployed on a fixed non-standard port with an iptables rule added to allow inbound C2 traffic — establishing persistent, system-level remote access (QiAnXin XLab, 2026-06-17). This combines T1133 External Remote Services (T1133) for the SSH backdoor with T1562.004 Impair Defenses: Disable or Modify System Firewall (T1562.004) for the firewall change. The router binary masquerades under a system-daemon-like process name (T1036 Masquerading, T1036).

Two malware variants, different capability tiers. The constrained RTL819X C variant carries massdns-style distributed DNS reconnaissance and a NAT-traversal tunnelling module (T1572 Protocol Tunneling, T1572; T1090.002 external proxy, T1090.002). The Go "Standard" variant for more-capable hosts (NAS) bundles off-the-shelf offensive tooling — fscan, ksubdomain, httpx, tlsx — for network-service discovery and subdomain enumeration (T1046 Network Service Discovery, T1046; T1595 Active Scanning, T1595), plus remote command execution and source-level payload execution in Go/Java/Python. C2 is HTTP/HTTPS with Protobuf message bodies under XOR obfuscation; a hardcoded key string embeds a 2024 marker, suggesting the operation predates the 2026 first-sighting.

Why this matters to a Swiss/EU public-sector SOC. The direct exposure is indirect but real: EoL D-Link SOHO routers persist in branch offices, municipal sites, and home-office setups, and QNAP NAS appliances are widely used as departmental file shares — both populations sit on the audience's attack surface, and Sweden's 6.4% share shows European devices are already being conscripted. A node's job is to scan and proxy, so a compromised device inside or adjacent to an organisation's network becomes a launch point for credential brute-forcing and lateral reconnaissance that looks like it originates from trusted infrastructure.

Hunt and detection concepts (no IOCs). On Linux/MIPS network appliances, hunt for an unexpected Dropbear (or any) SSH daemon listening on a non-standard port and for iptables rules added outside change management. On QNAP and other Linux NAS, alert on curl/python (or other interpreters) spawned from the security-utility process tree (T1059.006, T1059.006) and on file writes into /tmp/bin/ by a service account that should not be writing executables. Network-side, watch for bursts of outbound DNS queries consistent with mass subdomain brute-forcing from edge/IoT VLAN segments, and for long-lived outbound SSH from device-management ranges. Inventory edge devices for the affected D-Link models and for QNAP Malware Remover build numbers.

Hardening. Replace EoL D-Link DIR-850L / DIR-818LW (and same-era RTL819X models) — there is no firmware path. Patch QNAP Malware Remover to 6.6.8.20251023 or later. Restrict inbound SSH on management VLANs to known jump hosts, and apply egress filtering so SOHO/IoT segments cannot freely initiate outbound SSH or high-volume DNS. Attribution: XLab claims none; the brief reports the activity as XLab characterises it, not as a named actor.