Loading story…
Researchers at Lumen Black Lotus Labs reported a new botnet malware, KadNap, that compromises ASUS routers and other edge networking devices to convert them into residential-style proxies used to relay malicious traffic. First observed in the wild in August 2025, the botnet has grown to 14,000+ infected devices, with roughly 60% of victims located in the United States and additional concentrations in Taiwan, Hong Kong, and Russia, plus smaller numbers across multiple other countries.
KadNap is designed for resilience and evasion by using a custom Kademlia-based Distributed Hash Table (DHT) to obscure and decentralize command-and-control discovery, making takedowns and infrastructure mapping more difficult. Reported infection activity includes retrieval of a shell script aic.sh from 212.104.141[.]140 that establishes persistence via a cron job (running at the 55-minute mark each hour) and deploys an ELF payload (noted as kad) to install the client; infected nodes also query external IP and use NTP lookups for timing/uptime checks. Compromised devices are then monetized through a proxy service branded Doppelgänger (doppelganger[.]shop), assessed as a rebrand of Faceless, a proxy operation previously associated with TheMoon malware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Lumen said it had blocked traffic to and from KadNap's control infrastructure across its own network and planned to release indicators of compromise. This marked the first reported defensive response tied to the botnet's public disclosure.
In its public reporting, Black Lotus Labs revealed that KadNap used a custom Kademlia-based peer-to-peer architecture to obscure command-and-control infrastructure, making takedowns more difficult. Researchers also identified a weakness in the design: infected devices consistently contacted two intermediary nodes before reaching C2, providing defenders with a way to identify control infrastructure.
Black Lotus Labs assessed that access to KadNap-compromised devices was being sold through the Doppelganger proxy service, believed to be a rebrand of Faceless and associated with cybercrime activity such as brute-force attacks and targeted exploitation. This attribution connected the botnet to a broader malicious proxy ecosystem.
From its initial discovery in August 2025, KadNap expanded from about 10,000 daily infections to more than 14,000 compromised devices by March 2026. Most victims were located in the United States, with additional infections reported in countries including Taiwan, Hong Kong, the U.K., Brazil, France, Italy, Spain, and Russia.
Lumen's Black Lotus Labs first observed the KadNap malware campaign in August 2025, targeting primarily ASUS routers and other edge networking devices. The botnet used shell scripts, cron-based persistence, and ELF payloads to enroll ARM- and MIPS-based systems into a proxy network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcesecurityaffairs.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nokia Deepfield researchers reported that the **Jackskid** DDoS botnet, the **peer4you-mirai** hybrid malware, and the **trees4sale** residential proxy service are linked to a single operator that abuses **UPnP Internet Gateway Device** port mapping to expose infected residential devices directly to the internet. Instead of routing traffic through outbound tunnels, the malware opens about **165 external router ports** marked **"RELAY"**, converting compromised home devices into proxy exits. The report ties the operations together through shared relay code, a byte-identical `RCtea` configuration key, overlapping infrastructure, and cryptocurrency wallets funded by the same upstream source. The research says **peer4you-mirai** connects the DDoS and proxy activity, while newer Jackskid variants either deploy the relay as a second Android payload or embed it directly into Linux bot binaries. In addition to DDoS and proxy services, the operator reportedly uses compromised residential devices as a rotating **C2 relay mesh** populated from a `/nodes` director. The technique builds on the long-observed **UPnProxy** abuse pattern, but the newer campaign operationalizes it at scale for botnet control and commercial proxying. Defenders were urged to watch for **SSDP discovery**, SOAP `AddPortMapping` requests, and NAT entries whose description is **"RELAY"**, which the researchers described as strong indicators of compromise.
Aug 14, 2026
Researchers reported multiple campaigns compromising internet-facing edge devices, with **ASUS routers** and **Cisco Small Business/SOHO routers** heavily targeted to build stealthy botnets and relay infrastructure. GreyNoise and Censys tracked the **AyySSHush** campaign abusing legitimate ASUS firmware features, older authentication bypass paths, and `CVE-2023-39780` to enable logging functions, add attacker SSH keys, and expose backdoor access on **TCP/53282**; Censys identified **4,504 likely compromised ASUS devices** as of late May, after counts had previously surged above **10,000**. Sekoia separately observed a May campaign against ASUS routers using `CVE-2021-32030` to enable SSH on the same port, with more than **9,500 potentially affected devices**. At the same time, Sekoia detailed **PolarEdge** and **ViciousTrap**, campaigns exploiting `CVE-2023-20118` in Cisco routers and extending to devices from **QNAP, Synology, and ASUS**. PolarEdge used webshells and encrypted TLS backdoors to create an **Operational Relay Box** network of more than **2,000 devices**, while ViciousTrap installed NAT redirection rules to turn compromised systems into a distributed interception layer that forwarded inbound traffic to attacker-controlled servers; Sekoia counted **over 5,000 compromised devices** across many countries. Investigators also found overlap between the ASUS activity and infrastructure tied to ViciousTrap, suggesting at least some operators are reusing tooling and access across edge-device botnet operations, with residential ISP exposure indicating likely use for proxying, relays, or follow-on cyber activity.
Aug 15, 2026
Security researchers reported the emergence of **Win32/Napolar**—also marketed by its author as **solarbot**—as a new bot malware family used in the wild for credential theft, **DDoS**, SOCKS proxying, and remote payload execution. The malware was observed infecting victims primarily in **South America**, with notable concentrations in **Peru, Ecuador, and Colombia**, and it communicated with command-and-control servers over **HTTP** while encrypting commands with **RC4** keyed to the bot identifier. Analysis showed Napolar included advanced anti-analysis and evasion techniques uncommon for a newly surfaced crimeware family, including staged **TLS** decryption, runtime API resolution by hash, use of undocumented **NTDLL** functions, position-independent code, and self-debugging through code injection into a child process. Researchers also found browser-hooking capabilities for web-form theft and logic to detect and terminate processes containing `trusteer`, indicating attempts to bypass banking-browser protections; meanwhile, the malware was openly advertised online with builds reportedly sold for **$200**, along with changelogs, C2 server code, and plugin examples that pointed to a professionalized malware-for-sale operation.
Aug 15, 2026