Thousands of D-Link routers under control of AryStinger botnet

AryStinger is an active botnet composed of compromised end-of-life D‑Link DIR‑850L and DIR‑818LW routers (and some NAS devices) that uses 13‑year‑old vulnerabilities to turn devices into remotely controlled “Executors” for distributed scanning, proxying, DNS tampering, and command execution; researchers observed at least 4,300 infections. The report highlights privacy and abuse risks, detection signs (slow connectivity, DNS redirects, outbound spikes), and remediation steps including replacing EOL devices, applying the latest firmware, changing admin passwords, and disabling remote management.