AryStinger is a previously undocumented malware botnet that compromises outdated D-Link routers, specifically DIR-850L and DIR-818LW models, by exploiting known vulnerabilities CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837. Infected routers become 'executors' that perform distributed scanning, proxying, tunneling, and command execution tasks controlled by the attacker. The malware can alter DNS settings to hijack user browsing and monitor network traffic. Two variants exist: a C-based version targeting routers and a Go-based version targeting NAS devices with enhanced reconnaissance and code execution features. The botnet's infections are predominantly located in South Korea and China. The malware infrastructure supports distributed scanning and could be repurposed for large-scale DNS query attacks, though none have been observed. The botnet's full scope and attribution remain unclear.

AryStinger compromises outdated D-Link routers, turning them into proxies that facilitate malicious activities such as scanning, tunneling, and command execution. The malware's ability to tamper with DNS settings enables browsing hijacking and silent monitoring or theft of network traffic. This undermines network security and user privacy. The presence of a more advanced NAS-targeting variant increases the potential impact by enabling internal network reconnaissance and execution of arbitrary code. The botnet's distributed design enhances the efficiency and scale of attacks. The infection concentration in specific countries indicates regional impact but does not limit global risk.

No official patch or vendor advisory is provided in the available data. Users of affected D-Link router models (DIR-850L and DIR-818LW) should replace end-of-life devices with actively supported models. Applying the latest available firmware updates is recommended where possible. Additionally, changing default administrator passwords and disabling remote management interfaces can reduce exposure. Monitoring for unusual network activity related to proxying or DNS tampering is advisable. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.