4,300+ Outdated Routers Hijacked in Stealthy Spy Infrastructure by AryStinger malware

QiAnXin XLab reported the AryStinger campaign that has hijacked 4,300+ outdated RTL819X-based routers (predominantly D-Link DIR-850L) using older CVEs (CVE-2013-3307, CVE-2016-5681) and a later Go build exploiting CVE-2025-11837 against NAS devices; infected devices act as Executors to perform distributed reconnaissance (DNS/subdomain brute force, port/service scanning, TLS fingerprinting), tunnel traffic to hide operator location, and accept attacker-supplied scripts, while communicating with C2/download infrastructure including ajb8.com, dataexplore.cc, and dataexplore.co; recommended mitigation includes checking for outbound C2 connections, unexpected binaries in /tmp/bin, processes named syswapd0h/syswapd0w, and retiring unpatched legacy routers.