AryStinger Turns 4,300+ Routers into Recon Proxy Network

Colleagues — cybersecurity alert: QiAnXin XLab reports AryStinger converted over 4,300 legacy RTL819X routers into a distributed proxy network for reconnaissance.

What’s happening:
- Leveraging legacy CVEs (2013, 2016), primarily affecting D‑Link DIR‑850L.
- Nodes scan the Internet, gather fingerprints, tunnel traffic and relay C2.
- A secondary branch exploits CVE‑2025‑11837 against QNAP devices and can achieve code execution.

Mitigation:
- Retire EOL devices and disable remote access.
- Inspect /tmp/bin and processes syswapd0h/syswapd0w.
- Check for connections to known download domains (ajb8.com, etc.).

Why it matters: this infrastructure anonymizes the operator and facilitates reconnaissance prior to compromise.

How do you validate legacy devices in your environment?

#cybersecurity #IoT #vulnerabilities #networksecurity