AryStinger malware exploits two old vulnerabilities (CVE-2013-3307 and CVE-2016-5681) to infect routers based on Realtek RTL819X chips, mainly D-Link DIR-850L models, turning them into nodes for distributed reconnaissance and intrusion support. The malware does not perform destructive actions like encryption or mining but focuses on port scanning, service identification, and subdomain enumeration. It communicates with its C2 servers using HTTP with Protobuf-encoded and XOR-obfuscated traffic and maintains persistence by installing Dropbear SSH on port 2332. A second Go-based variant targets NAS devices via CVE-2025-11837, enabling execution of attacker-supplied source code in multiple languages. The distributed task architecture allows efficient scanning by dividing tasks among infected devices. The infection base exceeds 4,300 routers worldwide, with a significant presence in South Korea (48%) and China (32%). The malware has a very low detection rate in mainstream security tools, and the underlying hardware has not received firmware updates since 2015, making remediation challenging. The threat is ongoing and poses risks to personal privacy, enterprise security, and national security.

The malware compromises over 4,300 outdated routers, primarily D-Link DIR-850L devices, turning them into a covert network infrastructure for reconnaissance and intrusion support. This enables attackers to perform large-scale network scanning, service identification, and subdomain enumeration while hiding their true location. The infected devices act as persistent relay nodes, potentially exposing personal, enterprise, and national network environments to espionage and further attacks. The low detection rate and use of legacy hardware with no firmware updates increase the risk of prolonged undetected compromise. The malware's capabilities could facilitate subsequent intrusions and intelligence gathering, posing a medium-level threat to affected networks.

No official patch is available for the underlying vulnerabilities in the affected routers, as the hardware has not received firmware updates since 2015. The recommended mitigation is to retire and replace outdated routers that no longer receive security updates. Network defenders should monitor for outbound connections to known AryStinger C2 domains such as ajb8.com, dataexplore.cc, and dataexplore.co. Additionally, check infected devices for unexpected binaries in /tmp/bin and processes named syswapd0h or syswapd0w. Because the malware targets legacy hardware with no vendor support, hardware replacement is the most effective long-term remediation.