InfoSecBulletin Cybersecurity for mankind
AryStinger has taken control of over 4,000 old D-Link routers to use them as proxies for harmful traffic. The team at Qianxin’s XLab says that the malware turns infected devices into remote “executors.” These devices can scan, proxy, tunnel, run commands, and do other tasks for the attacker.
“The attacker can split a massive scanning task into multiple small chunks and distribute them to different Executors for parallel execution,” XLab researchers note.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“With this distributed-like design, the attacker can efficiently complete the early “footprinting” activities, thereby providing strong assurance for the smoothness and success rate of subsequent intrusion operations.”
The malware can change DNS settings, control the user’s browsing, and quietly watch all incoming and outgoing network traffic, possibly stealing information.
AryStinger uses old weaknesses like CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837. It mostly attacks D-Link DIR-850L and D-Link DIR-818LW routers.
The two router models were attacked by the AVrecon malware botnet that Lumen stopped in 2023.
Qianxin’s data shows that nearly half of all infections are in South Korea (48.5%). China is next at (31.8%), followed by Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%).
XLab researchers discovered two types of AryStinger malware: one written in C that mainly affects old routers, and another in Go that targets NAS systems but has a much smaller impact for now.
The NAS version is the better one of the two. It has extra features like IP and DNS scanning, running commands, executing payloads, and checking internal networks using open-source testing tools.
The researchers said that AryStinger’s DNS-scanning system might be used to create many DNS queries to resolvers, but they did not see any attacks like that.
XLab says the NAS version can run Shell commands and supports Go, Java, and Python code.
Source code has some downsides compared to compiled binaries. Compiling needs language runtimes on the host, and the whole process can create noise that makes stealth harder.
The researchers did not attribute AryStinger to any known activity cluster, stating that “many mysteries surrounding AryStinger remain to be solved.”
Owners of old routers should get new ones that are still supported, install the latest updates, change the default admin password, and turn off remote management panels.
