Ary Stinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
Summary: QiAnXin's XLab identified a malware family it calls AryStinger that has infected at least 4,300 routers built on Realtek RTL819X chips, hardware current around 2012 to 2015, and the count is still rising. First seen on March 12, 2026 spreading from a single IP, 107.150.106.14, the campaign pushes an undetected Linux ELF that exploits CVE-2013-3307 in Linksys models and CVE-2016-5681 in D-Link ones, with D-Link's DIR-850L making up about 75 percent of the pool and infections skewing to South Korea (around 48 percent) and China (around 32 percent).
What you should know: Each infected router becomes a footprinting node and relay that hides where the real attacker is, and a second strain seen on April 26 targets QNAP NAS boxes through CVE-2025-11837 in QNAP's Malware Remover, a flaw patched in November 2025 - so the way in is the appliance's own malware-removal tool.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2013-3307CVE-2016-5681CVE-2025-11837
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026