Skip to main content
UnknownPublished

type osint · KadNap botnet IOC (mainly Asus router)

Affects type osintSource CIRCL OSINT Feed

0

TLP:WHITE, disclosure is not limited

Description

KadNap botnet IOC (mainly Asus router)

Indicators of compromise

IP addresses 9

  • 45.135.180.38
  • 45.135.180.177
  • 91.193.19.51
  • 79.141.163.155
  • 23.227.203.221
  • 85.158.111.100
  • 89.46.38.74
  • 154.7.253.12
  • 79.141.161.152

Hashes 8

  • 0b3dbb951de7a216dd5032d783ba7d0a5ecda2bf872643c3a4ddd1667fb38ffemips
  • ebf9de6b67e94b2bd2b0dcda1941e04fef1a1dad830404813e468ab8744b7ed8arm
  • 5e0ab4ab2b53e8e1dbb74dd97c03979d
  • b81e1dcd55e9b6b169d52ee72dc061f90c123515
  • 0b3dbb951de7a216dd5032d783ba7d0a5ecda2bf872643c3a4ddd1667fb38ffe
  • 103710ebc767772eb0e033e0bb6c77da
  • 82d62c92d1e5d2e4b4571401b8dbd225d9216a0e
  • ebf9de6b67e94b2bd2b0dcda1941e04fef1a1dad830404813e468ab8744b7ed8

Text 5

  • Report
  • 15/65
  • 19/65
  • The Black Lotus Labs team at Lumen has discovered a sophisticated new malware named “KadNap.” This threat primarily targets Asus routers, conscripting them into a botnet that proxies malicious traffic. Since August 2025, we have been monitoring the growth of this network, which is now above 14,000 infected devices. KadNap employs a custom version of the Kademlia Distributed Hash Table (DHT) protocol, which is used to conceal the IP address of their infrastructure within a peer-to-peer system to evade traditional network monitoring. Infected devices use the DHT protocol to locate and connect with a command-and-control (C2) server, while defenders cannot easily find and add those C2s to threat lists. In short, the innovative use of the DHT protocol allows the malware to establish robust communication channels that are difficult to disrupt by hiding in the noise of legitimate peer-to-peer traffic. Once added to the network, bots are then marketed by a proxy service called “Doppelganger,” which is specifically tailored for criminal activity and appears to be a rebrand of the Faceless service, which was powered by victims of TheMoon malware. Using the expansive Lumen global backbone to observe KadNap’s infrastructure, we found that more than 60% of KadNap’s victims are based in the United States. While Asus routers are the primary targets, the operators are using the malware effectively against a variety of edge networking devices and set aside a number of C2s used to silo their infrastructure by victim type. As of this publication, Lumen has proactively blocked all network traffic to or from the control infrastructure. Given the obfuscation of C2 servers inherent to this protocol, Black Lotus Labs will share the indicators of compromise (IoCs) and will begin distributing the indicators of compromise (IoCs) into public feeds to enable others to help disrupt this threat. Lumen Technologies would like to thank our partners at Spur for their contributions to our efforts to track and mitigate this threat.
  • Report

Tlsh 2

  • t195644c07ff94aed7c857cd320878c753148ce59b5298213e31f8ca4dff6a60a4a578a9
  • t1d03408a1f8909e82c6906abffb1e828d330357bcd3ee31069e145b7427d7d594e3a941

Vhash 2

  • dc7e4b158cee8ed39dd2bf6e86fca227
  • 76becfa7727549d2bfb044bb67a602cb

Ssdeep 2

  • 6144:yDRe/kAR9jEeTTN8R15u9f/c+RZK4V3mD2RrD8gQmDjixe5xzjYF0XWj0fJd2XRW:yDRe/kAR9jEeTTN8R15u9f/c+RZV3mD/
  • 3072:DafTo5xJB61i+NODxTpSDMVrg88x2XxkncamNAHwEFjeAQ8kOWxtWGGaxXsWC/zi:iP1irxT3z80xknC6eAQ+LalC7UP

Community reviews

Loading reviews…