AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy D-Link/RTL819X Routers and NAS for Global Attack Proxy Infrastructure (CVE-2013-3307, CVE-2016-5681, CVE-2025-11837)
AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy (TL-2026-0894), also tracked as Ary-Attack, is a high-severity malware campaign scored CVSS 9.8, first published 2026-06-21. It has no confirmed attribution, affects D-Link DIR-850L (RTL819X), references 3 CVEs (CVE-2013-3307, CVE-2016-5681, CVE-2025-11837), maps to 25 MITRE ATT&CK techniques (T1016, T1021, T1027), and is covered by 9 detection rules and 32 indicators of compromise.
Key facts for TL-2026-0894
- Threat ID
- TL-2026-0894
- Also known as
- Ary-Attack, AryStinger
- Severity
- HIGH
- CVSS
- 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-21
- Last reviewed
- 2026-06-21
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- telecommunications, consumer, small-business, technology
- Target regions
- South Korea, China, Sweden, Malaysia, Singapore, Asia, Europe
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy
Malware and tooling: Ary-Attack custom HTTP executor framework, Netcat, fscan / ksubdomain / httpx / tlsx
AryStinger is an actively spreading multi-platform botnet, internally named 'Ary-Attack', that has compromised more than 4,300 legacy RTL819X-based D-Link routers (predominantly DIR-850L and DIR-818LW) plus an unknown number of D-Link NAS devices worldwide. It exploits known router and NAS vulnerabilities to turn devices into remotely controlled 'executors' for distributed scanning (port/service/subdomain/DNS), proxying, tunneling, command and source-code execution, and DNS hijacking. XLab (Qianxin) reported the campaign and did not attribute it to a known actor.
How AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy works
AryStinger is a botnet-as-attack-infrastructure operation tracked by Qianxin's XLab threat intelligence team, with an internal project name of 'Ary-Attack' derived from Go source-path hints in the malware. The operation builds a globally distributed cluster of compromised edge devices used as proxies and reconnaissance executors for downstream intrusion activity.
The campaign comprises two homologous but distinct malware families. The first is a C-implemented, MIPS (RTL819X) ELF binary ('RTL819X version') that targets outdated Realtek RTL819X-based SOHO routers — principally legacy D-Link models. XLab captured 32 versions of this variant; it is deployed as 'syswapd0' into /tmp/bin/ and is delivered via shell scripts downloaded from the operator's distribution servers after exploitation of CVE-2013-3307 and CVE-2016-5681. The second is a Go-implemented x86-64 ELF binary ('Standard version', UPX-packed, deployed as 'syswapd0-linux-amd64') that targets NAS devices via CVE-2025-11837 and carries richer capabilities: it captured 22 versions and supports dynamic interpreter-based execution of Shell, Go, Java and Python payloads, intranet mapping, and integrated offensive tooling (fscan, ksubdomain, httpx, tlsx).
Once installed, an executor registers with the C2 by collecting host fingerprint data (MAC address, device name, public/internal IP, OS version, CPU architecture, timestamp) and POSTing it to an /auth endpoint, which returns a numeric Executor ID. The bot then maintains a heartbeat against /heartbeat and /config for configuration updates, and pulls tasks from /cmd using an 'X-Executor-ID' header. The Standard version implements discrete task types — ScriptWork (shell/code execution), DnsWork, HttpAliveWork, HttpScanWork, DomainScanWork and IPScanWork — coordinating large-scale distributed subdomain enumeration, port/service scanning and HTTP probing across the bot fleet. Communications are obfuscated with XOR encryption using the hardcoded key 'sh_#@!_2024_secret', and the Standard version additionally uses Protobuf with Gzip compression.
Persistence and remote access differ by variant. The RTL819X variant deploys a Dropbear SSH backdoor on TCP port 2332 with supporting iptables rules; the Standard version deploys gs-netcat for remote shell and a separate tunneling component (nat_tunnel-linux-x86_64) delivered by a Python stager for proxying/tunneling. The malware also advertises a DNS-hijacking capability to tamper with victim DNS settings and redirect browsing. Detection rates against mainstream antivirus were near zero at time of reporting, and the nat_tunnel component is suspected of being partly AI-generated. Affected devices are concentrated in South Korea (48.45%) and China (31.82%), with additional infections in Sweden, Malaysia and Singapore. The botnet remains active and unattributed.
MITRE ATT&CK techniques used in TL-2026-0894
Discovery
T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1082 System Information Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1572 Protocol Tunneling; T1573 Encrypted Channel
Persistence
T1133 External Remote Services; T1505 Server Software Component; T1543 Create or Modify System Process
Initial Access
T1190 Exploit Public-Facing Application
Impact
Collection
Resource Development
T1584 Compromise Infrastructure; T1587 Develop Capabilities
Reconnaissance
T1590 Gather Victim Network Information; T1595 Active Scanning; T1596 Search Open Technical Databases
defense-impairment
Affected products and versions in AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy
- D-Link — DIR-850L (RTL819X)
Vulnerable versions: B1 2.07 before 2.07WWB05
Fixed in: 2.07WWB05 - D-Link — DIR-818LW / DIR-816L / DIR-818L / DIR-817LW / DWR-118 (RTL819X-based routers)
Vulnerable versions: legacy / end-of-life firmware - D-Link — Legacy NAS devices (end-of-life)
Vulnerable versions: affected by CVE-2025-11837 - Linksys — E1000 / E1200 / E3200 (CVE-2013-3307 family of RTL819X-class SOHO devices)
Vulnerable versions: E1000 through 2.1.02; E1200 before 2.0.05; E3200 through 1.0.04
Fixed in: E1200 2.0.05
Remediation for AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy
Patches
- Apply D-Link firmware updates where available (e.g. DIR-850L B1 2.07WWB05 or later for CVE-2016-5681); affected NAS lines (CVE-2025-11837) and many router lines are end-of-life with no fix
Immediate actions
- Identify and isolate legacy RTL819X-based D-Link routers (DIR-850L, DIR-818LW, DIR-816L, DIR-818L, DIR-817LW, DWR-118) and EoL D-Link NAS devices on the network
- Block the known C2 and distribution domains (*.ajb8.com, *.auq8.com, *.ahb8.com, opi7.com, io.ary2.com, sdkv1.dataexplore.cc/.co) and scanner IP 107.150.106.14 at the perimeter
- Inspect routers for an unexpected Dropbear SSH service listening on TCP/2332 and for processes named syswapd0, syswapd0h or syswapd0w
- Audit DNS settings on suspect devices for unauthorized changes (DNS hijacking)
Workarounds
- Disable remote/WAN management on affected devices
- Restrict device administration to a trusted management VLAN
- Replace EoL hardware where no vendor patch exists
Longer-term hardening
- Retire and replace end-of-life D-Link routers and NAS devices that no longer receive security updates
- Place IoT/SOHO devices on segmented VLANs with egress filtering and no inbound exposure
- Deploy network behavioral detection for outbound scanning bursts and tunneling characteristic of executor activity
CVEs associated with AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy
Weaknesses (CWE) in AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy
CWE-121, CWE-78, CWE-119, CWE-77
Timeline of AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy
- CVE-2013-3307 disclosed: OS command injection in D-Link DIR-series firmware via the apply.cgi ping_ip diagnostic parameter, one of the two router CVEs AryStinger later weaponizes for initial access on RTL819X devices.
- CVE-2016-5681 disclosed and acknowledged by D-Link in support announcement SAP10063: a stack-based buffer overflow in DIR-850L and related models enabling remote code execution; the second router CVE in AryStinger's exploitation chain.
- Hardcoded XOR key 'sh_#@!_2024_secret' embedded in the malware suggests campaign tooling dates back to at least 2024.
- XLab Network-wide Threat Awareness System detected IP 107.150.106.14 spreading the RTL819X ELF sample via CVE-2013-3307 and CVE-2016-5681; FBI FLASH notice on the same date named DIR-818LW, DIR-850L and DIR-860L as the most frequently compromised D-Link routers.
- A homologous Go-based ('Standard') sample targeting NAS devices via CVE-2025-11837 was captured; source-path hints reveal the internal project name 'Ary-Attack'.
- China's Ministry of State Security published a WeChat article referencing the activity.
- XLab (Qianxin) published the full technical analysis: 4,300+ RTL819X routers compromised, 32 RTL819X and 22 Standard malware versions captured, no attribution to a known actor.
- BleepingComputer reported on the AryStinger botnet, citing 4,000+ infected D-Link routers worldwide and an active, expanding campaign.
Sources cited for AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy
- AryStinger Botnet infected thousands of D-Link routers worldwide
- More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers (XLab/Qianxin)
- NVD - CVE-2016-5681 (D-Link DIR-850L stack-based buffer overflow)
- D-Link Support Announcement SAP10063 - CVE-2016-5681 router buffer overflow
- NVD - CVE-2013-3307 (OS command injection via apply.cgi ping_ip)
- CVE-2016-5681 GitHub Advisory (GHSA-x7m8-97xv-fx44)
- D-Link DIR-815 / DIR-850L exploit references (Exploit-DB)
Threats related to AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy
Detection coverage for TL-2026-0894
As of 2026-06-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0894 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.