AryStinger Explained: How Decade-Old Router Bugs Became 2026 Attack Infrastructure

AryStinger is a malware campaign, first observed on March 12, 2026, that has compromised more than 4,300 end-of-life routers and network-attached storage devices. It exploits old, unpatched vulnerabilities, namely CVE-2013-3307 in Linksys devices, CVE-2016-5681 in D-Link devices, and CVE-2025-11837 in QNAP storage, and turns the hardware into a reconnaissance and proxy network.

‍

Which devices and vulnerabilities are affected?

The campaign targets routers built on Realtek RTL819X chips, hardware that was current between roughly 2012 and 2015. The infected pool skews heavily to D-Link, with the DIR-850L alone accounting for about 75 percent of devices, alongside the DIR-818LW. The router intrusions use CVE-2013-3307 and CVE-2016-5681. A second variant, written in Go and observed on April 26, 2026, targets QNAP network-attached storage through CVE-2025-11837, a flaw demonstrated at Pwn2Own Ireland 2025 and patched by QNAP in late 2025.

‍

What does AryStinger do once it is in?

Unlike typical botnets, AryStinger is not built for denial-of-service or cryptocurrency mining. It is a reconnaissance and proxy cluster designed for the stage before a break-in. Infected devices scan the internet, fingerprint services, enumerate subdomains, tunnel traffic, execute commands, and can tamper with DNS settings to intercept traffic. A feature the researchers call ScriptWork runs attacker-supplied payloads in Go, Java, or Python directly on the device. The model resembles the operational relay box networks that make an attacker hard to trace.

‍

What should you do about it?

For the affected D-Link routers, no patch exists and none is coming, so the fix is to replace the hardware with a supported model. QNAP owners should confirm they have applied the QNAP Malware Remover update that closes CVE-2025-11837. To check for compromise, look for outbound connections to the campaign's command-and-control and download domains (ajb8.com, dataexplore.cc, and dataexplore.co), inspect the /tmp/bin directory for binaries you did not place there, and watch for processes named syswapd0h or syswapd0w.

‍

Why does this matter beyond routers?

Strip AryStinger down and there is no zero-day and no novel technique, just a 2013 bug, a 2016 bug, and a fleet of devices whose vendors walked away years ago. That is the point. End-of-life is not a future risk that arrives on a schedule; it is a present condition the moment patches stop shipping. The same principle applies to the end-of-life open-source frameworks, libraries, and runtimes still in production because they still work. HeroDevs cannot patch a router, but it does provide drop-in security patches for the end-of-life software running above it.

‍

Frequently asked questions

What is AryStinger?

A malware campaign that turns end-of-life routers and storage devices into a reconnaissance and proxy network.

Which CVEs does AryStinger exploit?

CVE-2013-3307 (Linksys), CVE-2016-5681 (D-Link), and CVE-2025-11837 (QNAP storage).

Which devices are most affected?

Mainly D-Link routers, with the DIR-850L making up about 75 percent of infections, plus the DIR-818LW.

Can the affected routers be patched?

No. The vendors ended firmware support, so the remedy is to replace the hardware.

How do I know if a device is infected?

Check for outbound traffic to ajb8.com, dataexplore.cc, and dataexplore.co, binaries in /tmp/bin, and processes named syswapd0h or syswapd0w.