AryStinger Botnet Uses Intranet Scanning and Traffic Tunneling to Hide Attacker Activity

AryStinger is a newly analyzed botnet that weaponizes outdated RTL819X-based routers and NAS devices by exploiting long-known vulnerabilities (e.g., CVE-2013-3307, CVE-2016-5681, CVE-2025-11837) to perform distributed scanning, intranet discovery, and traffic tunneling. The family uses compact C builds for routers and a Go "Standard" variant for NAS, employs a controller/Executor model with Protobuf-serialized, XOR-obfuscated communications over HTTP/HTTPS, and deploys lightweight backdoors (dropbear, gs-netcat, nat_tunnel) to maintain persistence; QiAnXin XLab telemetry found over 4,300 infected RTL819X routers concentrated in South Korea and China and identified hardcoded C2 domains (dybic.ajb8.com, opi7.com). Recommended mitigations include replacing or isolating end-of-life devices, applying patches where available, auditing edge devices for IOCs (C2 domains, dropbear ports, /tmp/bin artifacts), and enabling egress filtering.