[d-link]

October 16, 2026

• Compromised D-Link and Ubiquiti devices are being resold as residential proxy capacity. The proxyjacking campaign spans devices in 34 countries, turning victim connections into egress for a commercial proxy network and helping downstream abuse blend into residential traffic. GreyNoise details the infrastructure and detection opportunities. · Threat Activity & Espionage

in The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware

June 23, 2026

• AryStinger botnet enslaves 4,000+ D-Link devices — undocumented malware turns outdated routers and NAS boxes into a proxy network, raising risk of DNS tampering and traffic theft on EOL hardware. BleepingComputer · Malwarebytes · Threat Activity

in Five Eyes Warns Frontier AI Will Reshape Offensive Cyber Ops as a New Entra ID Conditional Access Bypass Surfaces

June 22, 2026

• AryStinger has infected 4,300+ legacy D-Link routers — but unusually, it builds them into a distributed reconnaissance and proxy network for pre-intrusion staging rather than a DDoS botnet, per QiAnXin's XLab. The Hacker News, XLab blog. · Threat Activity & CTI

in Unpatchable iPhone BootROM Exploit Drops as a New Call-Stack Bypass Defeats 2024-Era EDR