New KadNap botnet hijacks ASUS routers to fuel cybercrime proxy network

A newly discovered botnet named KadNap is compromising ASUS routers and other edge devices to build a peer-to-peer proxy network of roughly 14,000 infected hosts using a custom Kademlia-based DHT for C2, enabling resale of access via the Doppelganger proxy service for activities like DDoS and credential stuffing; researchers at Black Lotus Labs identified geographic distribution (60% US), persistence and evasion techniques, and implementation flaws that aided tracking, and Lumen has blocked related traffic on its network.