Ankura CTIX FLASH Update – June 24, 2026

Malware Activity

AryStinger Botnet Compromises Thousands of Routers to Build Distributed Proxy and Reconnaissance Network

Security researchers have identified a previously undocumented malware botnet dubbed AryStinger that has compromised more than 4,000 end-of-life routers and network-attached storage (NAS) devices, transforming them into a distributed infrastructure for malicious operations. The malware enables attackers to remotely control infected devices as “executors” capable of conducting internet-wide scanning, proxying, tunneling, command execution, and reconnaissance, allowing large tasks to be divided across many hosts to improve efficiency and evade detection. AryStinger primarily targets outdated D-Link routers by exploiting older vulnerabilities, including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, with infections concentrated in South Korea, China, and several other Asian and European countries. Researchers identified both a C-based variant focused on legacy