BotnetPublished 21 Jun 2026

AryStinger botnet infected thousands of D-Link routers worldwide

Source Bleeping Computer

Mentions 3 CVEs

Mentioned vulnerabilities

Description

A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated routers to turn them into proxies for malicious traffic. [...]

Impact

AryStinger compromises outdated D-Link routers, turning them into proxies that facilitate malicious activities such as scanning, tunneling, and command execution. The malware's ability to tamper with DNS settings enables browsing hijacking and silent monitoring or theft of network traffic. This undermines network security and user privacy. The presence of a more advanced NAS-targeting variant increases the potential impact by enabling internal network reconnaissance and execution of arbitrary code. The botnet's distributed design enhances the efficiency and scale of attacks. The infection concentration in specific countries indicates regional impact but does not limit global risk.

Defensive guidance

Users of affected D-Link router models (DIR-850L and DIR-818LW) should replace end-of-life devices with actively supported models. Applying the latest available firmware updates is recommended where possible. Additionally, changing default administrator passwords and disabling remote management interfaces can reduce exposure. Monitoring for unusual network activity related to proxying or DNS tampering is advisable.

References

bleepingcomputer.com/news/security/arystinger-botnet-infected-thousands-of-d-link-routers-worldwide/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jun 2026, 16:49 UTC

References

Community reviews

Related threats