Signal
AryStinger botnet hijacks thousands of legacy D-Link routers to form proxy network
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-06-22 06:57 UTCUpdated 2026-06-22 23:48 UTC
rss
botnetmalwareroutersnetwork_security
Trend in the last 24h
Current brief openSource links open
This current signal is open on the public brief with summary, metadata, source links, and full evidence. Pro adds compare-over-time, alerts, exports, and workflow.
No card needed for the free brief.
Evidence trail (top sources)
top sources (3 domains)domains are deduped. counts indicate coverage, not truth.3 top sources shown
Overview
The AryStinger botnet has compromised over 4,300 outdated D-Link routers, primarily models DIR-850L and DIR-818LW, exploiting vulnerabilities disclosed 13 years ago.
Entities
D-LinkAryStinger
Score total
1.21
Momentum 24h
3
Posts
3
Origins
3
Source types
1
Duplicate ratio
0%
Why now
- AryStinger infections are actively increasing, with over 4,300 devices compromised so far.
- The botnet exploits vulnerabilities disclosed over a decade ago, highlighting risks of outdated hardware.
- Awareness can prompt users and organizations to replace or secure legacy routers to mitigate ongoing threats.
Why it matters
- Legacy routers remain vulnerable due to lack of security patches, enabling persistent botnet infections.
- Compromised routers can be used to stage attacks and hide malicious activity, increasing threat actor stealth.
- Widespread use of unsupported devices in homes and small offices expands the attack surface for cybercriminals.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- AryStinger botnet has infected over 4,300 legacy D-Link routers worldwide
- AryStinger exploits vulnerabilities disclosed 13 years ago in unsupported router models DIR-850L and DIR-818LW
- Infected routers are used as a proxy network for reconnaissance and to hide attacker activity rather than for DDoS attacks
How sources frame it
- BankInfoSecurity: neutral
- Malwarebytes Threat Analysis: neutral
- The Hacker News: neutral
All evidence
All evidence
BankInfoSecurity report on AryStinger botnet
bankinfosecurity.com · bankinfosecurity.com · 2026-06-22 23:48 UTC
Thousands of D-Link routers under control of AryStinger botnet
Malwarebytes Threat Analysis · malwarebytes.com · 2026-06-22 15:22 UTC
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
thehackernews · thehackernews.com · 2026-06-22 06:57 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 3Origin domains: 3Duplicates: -
Showing 3 / 0
Top publishers (this list)
- bankinfosecurity.com (1)
- Malwarebytes Threat Analysis (1)
- thehackernews (1)
Top origin domains (this list)
- bankinfosecurity.com (1)
- malwarebytes.com (1)
- thehackernews.com (1)