KadNap P2P Botnet — 14,000+ Asus Routers Compromised via Custom Kademlia DHT C2 — Threadlinqs Intelligence
As of 2026-05-30, KadNap P2P Botnet — 14,000+ Asus Routers Compromised via Custom Kademlia DHT C2 is a high-severity malware threat attributed to a Russia-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0206 · Severity: HIGH · CVSS: 8.1 · Status: ACTIVE · Category: MALWARE
Attribution: Russia · FINANCIAL
Large-scale botnet targeting Asus home and SOHO routers using a custom Kademlia DHT-based peer-to-peer C2 infrastructure. Over 14,000 compromised devices (60% in the US) are monetized through the
KadNap is a sophisticated botnet malware discovered by Lumen Black Lotus Labs that primarily targets Asus home and SOHO routers, though it has been observed infecting other edge networking devices. The malware was first detected in August 2025 with approximately 10,000 compromised devices, growing to over 14,000 daily distinct victims by February 2026.
The infection chain begins with a shell script (aic.sh) downloaded from the initial staging server at 212.104.141.140. This script establishes persistence by creating a cron job that executes at the 55-minute mark of every hour, pulling and executing a malicious shell script renamed to .asusrouter stored at /jffs/.asusrouter. The script then downloads an architecture-appropriate ELF binary (supporting ARM and MIPS processors), renames it to 'kad', and executes it.
KadNap's most notable feature is its custom implementation of the Kademlia Distributed Hash Table (DHT) protocol for command-and-control communications. Upon execution, the malware forks a child process that connects to BitTorrent DHT bootstrap nodes to discover peers. It generates infohashes by creating a bencoded string using an XOR key computed from NTP server time (querying time-a.nist.gov, time-b.nist.gov, time.windows.com, ntp.asql.co.uk, chronos.csr.net) combined with system uptime. A hardcoded 0x40-byte string (6YL5aNSQv9hLJ42aDKqmnArjES4jxRbfPTnZDdBdpRhJkHJdxqMQmeyCrkg2CBQg) is SHA-1 hashed to derive AES encryption keys for peer communications.
Two persistent DHT nodes at 45.135.180.38 and 45.135.180.177 serve as stable entry points into the botnet's P2P network. Once a bot contacts these nodes, it receives C2 configuration files: .sose (stored at /tmp/.sose containing C2 IP:port pairs) and fwr.sh (stored at /tmp/.fwr.sh containing firewall rules). The malware actively blocks SSH access on port 22 to prevent administrator remediation.
The botnet infrastructure is segmented by device type, with separate C2 servers for Asus routers versus other edge devices. On average, three to four C2 servers are active at any given time. The operator infrastructure includes servers at 85.158.111.100, 89.46.38.74, 154.7.253.12, 212.104.141.88, 91.193.19.226, and 79.141.161.152.
Compromised devices are monetized through a proxy-as-a-service called Doppelganger (doppelganger.shop), which launched in May/June 2025 and is assessed to be a rebrand of the Faceless proxy service previously powered by TheMoon malware victims. Doppelganger claims to offer residential proxies across 50+ countries with '100% anonymity' and is specifically tailored for criminal activity including credential stuffing, brute-force attacks, and other malicious operations.
Geographically, over 60% of infected devices are located in the United States, with additional concentrations in Taiwan (5%), Hong Kong (5%), Russia (5%), and victims across the UK, Australia, Brazil, France, Italy, and Spain.
---
**Revalidated on 2026-03-12**
POST-DISCLOSURE UPDATE (2026-03-12): Following the March 10 public disclosure, Lumen has proactively null-routed all KadNap C2 traffic traversing its backbone infrastructure, providing partial disruption for traffic that routes through Lumen-operated networks. IOCs have been pushed to public threat intelligence feeds. However, due to KadNap's decentralized P2P architecture leveraging the Kademlia DHT protocol, the botnet remains structurally resilient — sinkholing individual nodes does not collapse the mesh, and infected devices will re-discover peers through DHT bootstrap. The Doppelganger proxy-as-a-service marketplace (doppelganger.shop) remains operational with no reported domain seizure or law enforcement action.
Two critical ASUS vulnerabilities disclosed in November 2025 — CVE-2025-59366 (CVSS 9.8, AiCloud authentication bypass via path traversal + OS command injection) and CVE-2025-59367 (CVSS 9.3, DSL router authentication bypass granting immediate administrative control) — affect the same ASUS router families targe
Weaknesses (CWE)
CWE-798, CWE-287, CWE-306
Target sectors: consumer, small-business, telecommunications, financial, government, healthcare
Target regions: North America, East Asia, Europe, Oceania, South America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1190, T1059, T1053, T1036, T1562, T1027, T1016, T1082, T1090, T1095