Security researchers have identified a previously undocumented malware botnet dubbed AryStinger that has compromised more than 4,000 end-of-life routers and network-attached storage (NAS) devices, transforming them into a distributed infrastructure for malicious operations. The malware enables attackers to remotely control infected devices as “executors” capable of conducting internet-wide scanning, proxying, tunneling, command execution, and reconnaissance, allowing large tasks to be divided across many hosts to improve efficiency and evade detection. AryStinger primarily targets outdated D-Link routers by exploiting older vulnerabilities, including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, with infections concentrated in South Korea, China, and several other Asian and European countries. Researchers identified both a C-based variant focused on legacy routers and a more advanced Go-based version targeting NAS devices, the latter featuring capabilities such as DNS and IP scanning, internal network reconnaissance, payload execution, and the ability to run Shell, Go, Java, and Python code on compromised systems. In addition to serving as a launchpad for future intrusions, the malware can alter DNS settings to hijack web traffic and potentially intercept or steal network communications. While researchers have not attributed AryStinger to any known threat actor or observed it being used for large-scale DNS attacks, they warn that its architecture could support such activity in the future and recommend replacing unsupported networking equipment, applying firmware updates, changing default credentials, and disabling remote management interfaces to mitigate risk. CTIX analysts will continue to write about novel malware and attack techniques.