KadNap Botnet Targeting Asus Routers via Kademlia DHT C2 for Doppelganger Proxy Network — Threadlinqs Intelligence
As of 2026-05-30, KadNap Botnet Targeting Asus Routers via Kademlia DHT C2 for Doppelganger Proxy Network is a high-severity malware threat attributed to Doppelganger Proxy Operators (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0212 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Doppelganger Proxy Operators · Russia · FINANCIAL
KadNap is a Linux botnet conscripting Asus routers and edge devices into the Doppelganger criminal proxy network using a custom Kademlia DHT protocol to hide C2 infrastructure. Active since August
KadNap is a sophisticated Linux botnet discovered by Lumen Black Lotus Labs that targets Asus routers and other edge networking devices running ARM and MIPS architectures. The malware employs a novel command-and-control mechanism based on a custom implementation of the Kademlia Distributed Hash Table (DHT) protocol, allowing it to conceal C2 infrastructure within legitimate BitTorrent peer-to-peer traffic.
The infection chain begins with the download of a shell script (aic.sh) from a payload delivery server. This script establishes persistence by creating a cron job that executes every hour at the 55-minute mark, ensuring the malware survives reboots and process termination. The script renames itself to .asusrouter in the /jffs/ directory — a partition on Asus routers that persists across firmware updates and reboots. It then downloads and executes the primary malicious ELF binary named 'kad', with variants compiled for both ARM and MIPS processor architectures.
The kad binary implements the custom Kademlia DHT C2 protocol through a multi-threaded architecture. First, it connects to hardcoded NTP servers (time-a.nist.gov, time-b.nist.gov, time.windows.com, ntp.asql.co.uk, chronos.csr.net) to fetch the current time and stores it alongside the host uptime. It then computes an XOR key from these timestamps combined with a hardcoded string (6YL5aNSQv9hLJ42aDKqmnArjES4jxRbfPTnZDdBdpRhJkHJdxqMQmeyCrkg2CBQg), which is SHA-1 hashed and used as an infohash for BitTorrent DHT peer discovery.
Two primary communication threads operate in parallel: a Find Peers thread that connects to BitTorrent DHT bootstrap nodes to search for infected nodes, and a Contact Peers thread that receives a 0x1000-byte encrypted buffer from discovered peers. The initial handshake uses a hardcoded AES key, and the first payload's SHA-1 hash becomes the AES key for all subsequent communications. The final peer in the chain delivers two operational files: fwr.sh (which injects iptables rules to drop incoming TCP traffic on port 22, blocking SSH access and preventing remote remediation) and .sose (a C2 configuration file stored in /tmp/).
Despite the decentralized DHT design, Black Lotus Labs identified that operators maintain two persistent final-hop DHT nodes (45.135.180.38 and 45.135.180.177), representing centralized control points and potential single points of failure. The C2 infrastructure is segmented by device type, with approximately 2 servers dedicated to Asus devices (over 50% of the botnet) and 2 servers for other edge devices.
The botnet feeds the Doppelganger proxy service (doppelganger.shop), which markets anonymous residential proxies for criminal use. Doppelganger is assessed with high confidence by both Black Lotus Labs and Spur security firm to be a successor/rebrand of the defunct Faceless proxy service, which previously monetized victims of TheMoon malware. Users of the proxy service leverage hijacked devices for brute-force credential attacks, targeted exploitation campaigns, and other malicious activities.
The botnet grew from an initial detection of 10,000+ compromised Asus devices in August 2025 to a stable plateau of approximately 14,000 daily active infected devices by December 2025 through February 2026. Geographic distribution shows 60% of victims in the United States, with additional concentrations in Taiwan (5%), Hong Kong (5%), Russia (5%), and smaller percentages in the UK, Australia, Brazil, France, Italy, and Spain.
Lumen has proactively blocked all network traffic to and from the identified control infrastructure and has distributed IOCs to public threat feeds.
---
**Revalidated on 2026-03-12**
Two days after the initial Black Lotus Labs public disclosure, KadNap has been independently confirmed and amplified by over a dozen security publishers including the Cloud Security Alliance, SC Media, Security Affairs, TechRadar, Aviatrix, and The Hacker News. The threat is assessed as fully active with no observed decline in
Target sectors: telecommunications, residential, small-business, isp-infrastructure, government, financial
Target regions: North America, United States, Taiwan, Hong Kong, Russia, United Kingdom, Australia, Brazil, France, Italy, Spain
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1190, T1059, T1053, T1547, T1036, T1027, T1562, T1016, T1082, T1040