AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

A sophisticated new malware threat has emerged that is repurposing thousands of outdated home routers into a reconnaissance network, marking a significant shift from the typical DDoS botnet campaigns that typically target such devices. Named AryStinger by researchers at QiAnXin's XLab, this malware has already compromised at least 4,300 legacy routers, with infection numbers continuing to climb. Unlike conventional router malware that floods targets with traffic, AryStinger is designed to operate quietly in the background, serving as a distributed proxy network for cybercriminals conducting preliminary attack reconnaissance.

AryStinger specifically targets older router models that have reached end-of-life status and no longer receive security updates from manufacturers. These devices, often overlooked by homeowners and small businesses, present an ideal attack surface due to their unpatched vulnerabilities and constant internet connectivity. Once infected, these