# AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy D-Link/RTL819X Routers and NAS for Global Attack Proxy Infrastructure (CVE-2013-3307, CVE-2016-5681, CVE-2025-11837)

> AryStinger is an actively spreading multi-platform botnet, internally named 'Ary-Attack', that has compromised more than 4,300 legacy RTL819X-based D-Link routers (predominantly DIR-850L and DIR-818LW) plus an unknown number of D-Link NAS devices worldwide. It exploits known router and NAS vulnerabilities to turn devices into remotely controlled 'executors' for distributed scanning (port/service/subdomain/DNS), proxying, tunneling, command and source-code execution, and DNS hijacking. XLab (Qianxin) reported the campaign and did not attribute it to a known actor.

- **Published:** 2026-06-21T00:00:00Z
- **Last reviewed:** 2026-06-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0894
- **ID:** TL-2026-0894
- **Severity:** HIGH (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2013-3307, CVE-2016-5681, CVE-2025-11837

## Description

AryStinger is a botnet-as-attack-infrastructure operation tracked by Qianxin's XLab threat intelligence team, with an internal project name of 'Ary-Attack' derived from Go source-path hints in the malware. The operation builds a globally distributed cluster of compromised edge devices used as proxies and reconnaissance executors for downstream intrusion activity.

The campaign comprises two homologous but distinct malware families. The first is a C-implemented, MIPS (RTL819X) ELF binary ('RTL819X version') that targets outdated Realtek RTL819X-based SOHO routers — principally legacy D-Link models. XLab captured 32 versions of this variant; it is deployed as 'syswapd0' into /tmp/bin/ and is delivered via shell scripts downloaded from the operator's distribution servers after exploitation of CVE-2013-3307 and CVE-2016-5681. The second is a Go-implemented x86-64 ELF binary ('Standard version', UPX-packed, deployed as 'syswapd0-linux-amd64') that targets NAS devices via CVE-2025-11837 and carries richer capabilities: it captured 22 versions and supports dynamic interpreter-based execution of Shell, Go, Java and Python payloads, intranet mapping, and integrated offensive tooling (fscan, ksubdomain, httpx, tlsx).

Once installed, an executor registers with the C2 by collecting host fingerprint data (MAC address, device name, public/internal IP, OS version, CPU architecture, timestamp) and POSTing it to an /auth endpoint, which returns a numeric Executor ID. The bot then maintains a heartbeat against /heartbeat and /config for configuration updates, and pulls tasks from /cmd using an 'X-Executor-ID' header. The Standard version implements discrete task types — ScriptWork (shell/code execution), DnsWork, HttpAliveWork, HttpScanWork, DomainScanWork and IPScanWork — coordinating large-scale distributed subdomain enumeration, port/service scanning and HTTP probing across the bot fleet. Communications are obfuscated with XOR encryption using the hardcoded key 'sh_#@!_2024_secret', and the Standard version additionally uses Protobuf with Gzip compression.

Persistence and remote access differ by variant. The RTL819X variant deploys a Dropbear SSH backdoor on TCP port 2332 with supporting iptables rules; the Standard version deploys gs-netcat for remote shell and a separate tunneling component (nat_tunnel-linux-x86_64) delivered by a Python stager for proxying/tunneling. The malware also advertises a DNS-hijacking capability to tamper with victim DNS settings and redirect browsing. Detection rates against mainstream antivirus were near zero at time of reporting, and the nat_tunnel component is suspected of being partly AI-generated. Affected devices are concentrated in South Korea (48.45%) and China (31.82%), with additional infections in Sweden, Malaysia and Singapore. The botnet remains active and unattributed.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1596 Search Open Technical Databases
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1133 External Remote Services
- T1543 Create or Modify System Process
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1557 Adversary-in-the-Middle
- T1496 Resource Hijacking

## Sources

- [AryStinger Botnet infected thousands of D-Link routers worldwide](https://www.bleepingcomputer.com/news/security/arystinger-botnet-infected-thousands-of-d-link-routers-worldwide/)
- [More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers (XLab/Qianxin)](https://blog.xlab.qianxin.com/arystinger-botnet-hijacks-legacy-routers-for-global-attacks-en/)
- [NVD - CVE-2016-5681 (D-Link DIR-850L stack-based buffer overflow)](https://nvd.nist.gov/vuln/detail/CVE-2016-5681)
- [D-Link Support Announcement SAP10063 - CVE-2016-5681 router buffer overflow](https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=sap10063)
- [NVD - CVE-2013-3307 (OS command injection via apply.cgi ping_ip)](https://nvd.nist.gov/vuln/detail/CVE-2013-3307)
- [CVE-2016-5681 GitHub Advisory (GHSA-x7m8-97xv-fx44)](https://github.com/advisories/GHSA-x7m8-97xv-fx44)
- [D-Link DIR-815 / DIR-850L exploit references (Exploit-DB)](https://www.exploit-db.com/exploits/38715)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0894