Silence of the Hops: The KadNap Botnet Conscripts 14,000 Routers

Black Lotus Labs disclosed a sophisticated botnet named "KadNap" that has infected over 14,000 devices (primarily Asus routers) to form a decentralized proxy network. KadNap uses a custom Kademlia-based P2P DHT to hide its infrastructure and evade takedown, includes persistence via an hourly cron job (aic.sh), and its compromised routers are marketed through a dark-web proxy service called "Doppelgänger"; Lumen published IoCs and recommended mitigations (firmware updates, change default credentials, monitor cron jobs, replace EOL routers).