AryStinger Botnet Uses Intranet Scanning and Traffic Tunneling to Hide Attacker Activity

A newly analyzed botnet family, AryStinger, weaponizes long‑neglected routers and NAS appliances to build a stealthy reconnaissance and relay infrastructure that helps attackers obscure origin and extend lateral reach.

AryStinger leverages decade‑old vulnerabilities in RTL819X‑based routers and a more feature‑rich Go‑implemented “Standard” branch on NAS devices to perform distributed scanning, intranet discovery, and traffic tunneling turning compromised edge devices into covert stepping stones for espionage and follow‑on attacks.

At core, AryStinger implements a controller/Executor model: each infected device authenticates to C2 servers and receives an Executor ID that uniquely identifies it for subsequent tasking.

Communications use Protobuf serialization with layered compression and simple XOR obfuscation (the family uses a hardcoded key sh_#@!_2024_secret), transported over HTTP/HTTPS.

The RTL819X builds are compact C binaries for constrained routers and support mass DNS and HTTP scanning plus a tunnel module; the Standard variant (Go) targets NAS hosts and broadens capabilities to include multi‑type scanning, script‑level payload execution (Go/Java/Python), and integrated intranet reconnaissance via toolsets such as Fscan and Ksubdomain.

This allows parallelized footprinting while keeping each node’s activity low and less suspicious. ScriptWork notably lets operators push source payloads to execute directly on targets, providing rapid flexibility across platforms but increasing exposure when interpreters or plaintext payloads are written to disk.

QiAnXin XLab’s field of view, specifically targeting router devices based on the RTL819X series chips. AryStinger’s task architecture is modular and distributed. The C2 issues fine‑grained jobs DNS brute force, IP scans, HTTP Alive checks, and ScriptWork tasks which the attacker shards across many Executors.

For persistent control, the malware deploys lightweight backdoors: RTL819X builds download and run dropbear SSH on a fixed port, while Standard builds install gs‑netcat or a nat_tunnel binary to proxy traffic.

AryStinger Botnet Uses Intranet Scanning

The tunnel components appear reused between variants and enable traffic forwarding that masks the attacker’s true location and helps pivot into otherwise isolated networks.

Operational telemetry shows worrying scale and selectivity. QiAnXin’s asset mapping found over 4,300 infected RTL819X routers worldwide heavily concentrated in South Korea and China and primarily affecting D‑Link models with NAS infections also observed but not fully quantified.

Infections spread using publicized flaws such as CVE‑2013‑3307, CVE‑2016‑5681 for routers, and CVE‑2025‑11837 for NAS devices, reflecting an attacker strategy of reviving long‑known exposures to compromise legacy firmware that lacks vendor updates.

The threat model here is threefold: persistent eavesdropping of network traffic, DNS hijacking access or content manipulation at the gateway, and concealment of follow‑on offensive operations.

AryStinger Standard hardcodes two C2 addresses, dybic.ajb8.com and opi7.com, with communication based on the HTTPS protocol.

Because AryStinger encodes and fragments scanning tasks and employs tunnels, defenders face attribution and cleanup challenges: attacks routed through many compromised gateways produce misleading source artifacts and lengthen remediation windows.

Defensive recommendations are immediate and pragmatic. Prioritize replacement or isolation of end‑of‑life routers and NAS devices, patch where vendor fixes exist, and audit edge devices for known IOCs such as the C2 domains and dropbear listening ports referenced in the XLab report.

Network defenders should enable egress filtering, monitor for unusual outbound HTTPS to hardcoded domains, and scan device filesystems (notably /tmp/bin) for dropped toolsets.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.