Malwaremedium
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-5681 | Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before… | 9.8 | 12% | ||
| CVE-2025-11837 | An improper control of generation of code vulnerability has been reported to affect Malware Remover | 8.1 | 1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ajb8.com | nd connections to AryStinger's C2 and download domains (the ajb8.com and related hosts in XLab's IOC list ), check /tmp/bin for |
| ipv4 | 107.150.106.14 | first saw it on March 12, 2026, spreading from a single IP, 107.150.106.14. The binary it pushed was a Linux ELF that no engine on Vir |
From the original article
3 min read at thehackernews.com
Swati Khandelwal Jun 22, 2026 IoT Security / Vulnerability A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. QiAnXin's XLab calls it AryStinger and counts at least 4,300 infected routers, a total it says is still rising. The distinction matters.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.