kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · not yet in the cluster map

arystinger

2 stories · 2 in the wild · June 22, 2026 – June 25, 2026

evidence: 2 observed

sectors

  • critical infrastructure 1 · Jun 22

geography

  • china 1 · Jun 25
  • south korea 1 · Jun 25
  • global 1 · Jun 22

malware and tools

  • arystinger 2 · Jun 25

techniques

  • network hijacking 1 · Jun 25

attack phases seen

  • Persistence 2 · Jun 25
  • Initial access 1 · Jun 25
  • Execution 1 · Jun 22

what we reported, newest first, grouped by story

Jun 22 – June 25, 2026 · 2 reports

  • AryStinger, a previously undocumented Linux botnet, hijacks EoL routers and QNAP NAS as a covert reconnaissance-and-proxy network rather than for DDoS/mining. It uses an Executor/Controller model, n-day CVEs (CVE-2013-3307, CVE-2016-5681, CVE-2025-11837), Protobuf+XOR C2, and Dropbear/gs-netcat persistence; 4,300+ routers confirmed (mostly South Korea and China, ~75% D-Link DIR-850L), initial samples at 0/VirusTotal. XLab via FalconFeeds · Jun 25 · observed · Threat Intelligence
  • AryStinger has infected 4,300+ legacy D-Link routers — but unusually, it builds them into a distributed reconnaissance and proxy network for pre-intrusion staging rather than a DDoS botnet, per QiAnXin's XLab. The Hacker News, XLab blog. · Jun 22 · observed · Threat Activity & CTI