Malwarecritical
4,300+ Outdated Routers Hijacked in Stealthy Spy Infrastructure by AryStinger malware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-5681 | Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before… | 9.8 | 12% | ||
| CVE-2025-11837 | An improper control of generation of code vulnerability has been reported to affect Malware Remover | 8.1 | 1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ajb8.com | s to AryStinger’s C2 and download infrastructure, primarily ajb8.com , dataexplore.cc , and dataexplore.co hostnames. Check /tmp |
| domain | dataexplore.cc | nger’s C2 and download infrastructure, primarily ajb8.com , dataexplore.cc , and dataexplore.co hostnames. Check /tmp/bin for binaries |
| domain | dataexplore.co | d infrastructure, primarily ajb8.com , dataexplore.cc , and dataexplore.co hostnames. Check /tmp/bin for binaries you didn’t put there |
| ipv4 | 107.150.106.14 | s XLab threat detection system flagged a single IP address, 107.150.106.14, spreading a Linux binary through two vulnerabilities that |
From the original article
5 min read at securityaffairs.com
AryStinger hijacks outdated routers via old flaws, turning 4,300+ devices into a stealth network for reconnaissance and intrusion support. On March 12, 2026, QiAnXin’s XLab threat detection system flagged a single IP address, 107. 150.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.