AryStinger — Router/NAS Recon-and-Proxy Botnet

AryStinger (QiAnXin XLab, disclosed 2026-06-22) is a botnet that has hijacked at least 4,300 end-of-life network devices — predominantly D-Link DIR-850L routers (~75%) and other Realtek RTL819X-based models (2012–2015 era), plus QNAP NAS boxes — and turned each into an "Executor": a remotely controlled node for internal/external network scanning, traffic tunneling, proxying, and command execution. The campaign was first observed 2026-03-12 spreading from a single source IP (107.150.106.14); a second, QNAP-focused strain appeared 2026-04-26.

Entry: AryStinger does not use a 0-day — it exploits decade-old N-day flaws on unpatched, EOL gear: CVE-2013-3307 (Linksys), CVE-2016-5681 (D-Link), and CVE-2025-11837 (a code-injection flaw in QNAP's Malware Remover). Two builds exist: a C-based variant for routers and a Go-based variant for NAS that runs recon tools (fscan, ksubdomain, httpx) and supports "ScriptWork" execution of attacker-supplied Go/Java/Python source.

Tradecraft & persistence: the implant drops a Linux ELF (process names syswapd0h / syswapd0w, staged under /tmp/bin), authenticates to C2 (eixfi.ajb8.com/auth) to receive an Executor ID, and communicates over HTTP/HTTPS with Protobuf + XOR (the Go build adds gzip). It establishes persistence via a Dropbear SSH server on port 2332 (routers) or gs-netcat (NAS), embeds a hardcoded SSH key string sh_#@!_2024_secret, and can tamper with DNS settings to hijack victims' browsing toward phishing/malware.

Defender priority: The infected devices are unmanaged appliances (no Falcon sensor), so this pack hunts the blast radius inside your estate: (1) any Falcon-covered Linux host that gets the implant (/tmp/bin ELF, syswapd0h/0w, rogue Dropbear on 2332, recon-tool execution); (2) internal scanning / proxy traffic on port 2332; and (3) an atomic sweep for the ajb8.com C2 / source IP across DNS and network. Patch or retire EOL routers/NAS — that is the only fix for the appliances themselves.

Provenance note: all atomic IOCs in §4/§10 (C2 domains under ajb8.com + opi7.com, source IP 107.150.106.14, process names syswapd0h/0w, path /tmp/bin, Dropbear port 2332, hardcoded key sh_#@!_2024_secret) are taken from the cited XLab/THN reporting — none are fabricated. The IOCs apply to infected device / managed-Linux telemetry; the consumer appliances themselves are out of Falcon's reach (§15).

Hunt hypotheses

• H1: A Falcon-covered Linux host runs the AryStinger implant — process syswapd0h/syswapd0w or an ELF staged under /tmp/bin.
• H2: A managed host runs the Executor recon toolkit — fscan, ksubdomain, httpx, or gs-netcat — sweeping internal/external ranges.
• H3: A rogue Dropbear SSH listener on port 2332 appears on a managed host (router/NAS-style persistence ported to a server).
• H4: Any host resolves or connects to the AryStinger C2 (*.ajb8.com, opi7.com) or the source IP 107.150.106.14.
• H5: A managed host connects to an internal device on port 2332 — using a compromised router/NAS as a proxy/tunnel pivot.

Attack chain

Atomic indicators below are from cited XLab/THN reporting. C2 may rotate; the IP is a single observed source. Validate before estate-wide blocking.

Directly compromised: EOL D-Link DIR-850L / DIR-818LW and other Realtek RTL819X routers, plus QNAP NAS running a vulnerable Malware Remover — all unmanaged appliances. Falcon-visible blast radius: any Linux server/workstation that gets the portable ELF implant, plus the scanning/proxy/DNS-hijack effects the botnet has on your managed estate.

The botnet lives on unmanaged appliances, so the appliance-side hunt is device/network-native; the §8 CQL covers managed Linux hosts and estate-wide sweeps.

Gateway / NDR (network-side)

# At the perimeter / NDR, hunt for the botnet's C2 and persistence ports:
#  - DNS queries for *.ajb8.com (eixfi/dybic/hgodpcx) and opi7.com
#  - Any device connecting to/from 107.150.106.14
#  - Inbound/outbound tcp/2332 (Dropbear) to or from consumer-grade devices
#  - DHCP/DNS config drift: clients suddenly using an unexpected DNS resolver

Router / NAS appliance checks (device-native)

• On QNAP: confirm Malware Remover is updated (CVE-2025-11837) and audit for unexpected SSH/gs-netcat processes and listeners.
• On D-Link / Realtek routers: these are EOL — assume-breach if reachable from untrusted networks; check for a listener on 2332 and altered DNS settings, then retire/replace.
• Network-wide: look for internal hosts being port-scanned from a router/NAS IP (botnet recon fan-out).

Linux host (managed, auditd)

• Watch for execve of /tmp/bin contents, or process names syswapd0h/syswapd0w.
• Watch for dropbear binding 2332, or execution of fscan/ksubdomain/httpx/gs-netcat.

Because the core of AryStinger runs on devices CrowdStrike can't see, NDR/firewall visibility on the C2 indicators and port 2332 is the primary appliance-side control — pair it with the Falcon queries in §8 for the managed estate.

Scope note: the compromised routers/NAS have no Falcon sensor — Q1–Q3 catch a managed Linux host that gets the portable implant; Q4 is an estate-wide atomic sweep; Q5 finds hosts pivoting through an infected device's proxy port.

// HUNT: AryStinger ELF implant — syswapd0h/0w or /tmp/bin execution (Linux)
// MITRE: T1059.004, T1105 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (Linux)
// FALSE POSITIVES: rare; some build tooling uses /tmp — confirm process name + path
// TUNING: keep event_platform=Lin; widen ImageFileName if the implant is renamed
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Lin
| ImageFileName=/(syswapd0[hw]|\/tmp\/bin(\/|$))/i
| groupBy([ComputerName, ImageFileName, CommandLine], function=([count(aid, as=hits), collect([UserName])]))
| sort(hits, order=desc)

// HUNT: AryStinger Executor recon/tunnel toolkit (fscan/ksubdomain/httpx/gs-netcat)
// MITRE: T1046, T1595, T1572 | CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2 (Linux)
// FALSE POSITIVES: sanctioned pentest/recon hosts — allowlist by aid/ComputerName
// TUNING: exclude approved security tooling hosts; correlate with Q1/Q3 on same host
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Lin
| ImageFileName=/\/(fscan|ksubdomain|httpx|gs-netcat)$/i
| groupBy([ComputerName, ImageFileName, CommandLine], function=([count(aid, as=hits), collect([UserName])]))
| sort(hits, order=desc)

// HUNT: AryStinger Dropbear/SSH persistence listener on tcp/2332 (Linux)
// MITRE: T1543, T1571 | CONF: high  FP: low  COST: low | REQUIRES: NetworkListenIP4 (Linux)
// FALSE POSITIVES: low; confirm no sanctioned service binds 2332
// TUNING: pair with Q1; alert on any new LocalPort=2332 listener
#event_simpleName=/NetworkListenIP4/
| event_platform=Lin
| LocalPort=2332
| groupBy([ComputerName, LocalAddressIP4, LocalPort, ContextBaseFileName], function=([count(aid, as=hits), collect([ImageFileName])]))
| sort(hits, order=desc)

// HUNT: AryStinger atomic C2 sweep — *.ajb8.com / opi7.com / 107.150.106.14
// MITRE: T1071.001 | CONF: high  FP: low  COST: low | REQUIRES: DnsRequest / NetworkConnectIP4
// FALSE POSITIVES: low; extend the domain list as new C2 surfaces
// TUNING: add newly reported ajb8.com subdomains; confirm IP before broad block
#event_simpleName=/DnsRequest|NetworkConnectIP4/
| DomainName=/(^|\.)(ajb8\.com|opi7\.com)$/i OR RemoteAddressIP4=/^107\.150\.106\.14$/
| groupBy([ComputerName, DomainName, RemoteAddressIP4, RemotePort], function=([count(aid, as=hits), collect([ContextBaseFileName])]))
| sort(hits, order=desc)

// HUNT: Connection to an AryStinger Dropbear/proxy port (tcp/2332) on an internal device
// MITRE: T1090, T1572 | CONF: medium  FP: medium  COST: low | REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: any sanctioned 2332 service — baseline first
// TUNING: restrict RemoteAddressIP4 to your RFC1918 ranges; allowlist known peers
#event_simpleName=/NetworkConnectIP4/
| RemotePort=2332
| RemoteAddressIP4=/^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
| groupBy([ComputerName, RemoteAddressIP4, RemotePort, ContextBaseFileName], function=count(aid, as=conns))
| sort(conns, order=desc)

Field-name note: queries use standard Falcon fields (#event_simpleName, event_platform, ImageFileName, CommandLine, LocalAddressIP4, LocalPort, RemoteAddressIP4, RemotePort, DomainName, ContextBaseFileName, ComputerName, aid, UserName). Confirm NetworkListenIP4 is collected on your Linux fleet for Q3.

The implant and persistence IOAs are high fidelity on managed Linux. The recon-toolkit IOA is dual-use — scope it away from your security team's scanning hosts. Promote the implant IOA to Prevent first.

Atomic indicators are from cited XLab/THN reporting and ready to import. The IP is a single observed source — set it to detect/validate before a hard block. Domains may rotate under ajb8.com.

type,value,action,severity,expiration,description,tags
domain,eixfi.ajb8.com,block,high,2026-09-26,AryStinger C2 auth interface,campaign:arystinger
domain,dybic.ajb8.com,block,high,2026-09-26,AryStinger C2,campaign:arystinger
domain,hgodpcx.ajb8.com,block,high,2026-09-26,AryStinger dropbear download server,campaign:arystinger
domain,opi7.com,block,high,2026-09-26,AryStinger hardcoded C2,campaign:arystinger
ipv4,107.150.106.14,detect,medium,2026-09-26,AryStinger spreading source IP (validate),campaign:arystinger

PROC   syswapd0h , syswapd0w                  -> AryStinger implant process names
PATH   /tmp/bin                                -> ELF staging location
PORT   tcp/2332 (Dropbear SSH)                 -> persistence / proxy listener
TOOLS  fscan , ksubdomain , httpx , gs-netcat  -> Executor recon/tunnel toolkit
KEY    sh_#@!_2024_secret                      -> hardcoded SSH key string (YARA/strings)

BEHAVIOR: process syswapd0h/0w or exec from /tmp/bin (Linux)         -> detect (Q1)
BEHAVIOR: fscan/ksubdomain/httpx/gs-netcat on a non-security host    -> hunt   (Q2)
BEHAVIOR: new listening socket on tcp/2332                           -> detect (Q3)
BEHAVIOR: resolve/connect to *.ajb8.com / opi7.com / 107.150.106.14  -> block  (Q4)
BEHAVIOR: outbound to internal tcp/2332 (proxy pivot)               -> hunt   (Q5)

CVE: 2013-3307 (Linksys) | 2016-5681 (D-Link) | 2025-11837 (QNAP Malware Remover)
DEVICES: D-Link DIR-850L / DIR-818LW (EOL) , Realtek RTL819X routers , QNAP NAS
ACTION: patch QNAP Malware Remover; RETIRE/REPLACE EOL D-Link/Realtek routers
CHECK: device listener on 2332 ; altered DNS settings ; gs-netcat process (NAS)
DISCLOSED: 2026-06-22 (XLab) | first seen 2026-03-12 | QNAP strain 2026-04-26

1 · Sweep managed Linux hosts for the implant (Falcon RTR / Ansible, read-only)

#!/bin/bash
# Read-only enumeration — capture evidence before remediation.
ps -eo comm,pid,user | grep -Ei "syswapd0[hw]"
ls -la /tmp/bin 2>/dev/null
ss -ltnp 2>/dev/null | grep -E ":2332\b"
for t in fscan ksubdomain httpx gs-netcat; do command -v "$t" && echo "RECON TOOL present: $t"; done

2 · Block C2 + persistence port at the edge

# DNS/proxy denylist:
eixfi.ajb8.com
dybic.ajb8.com
hgodpcx.ajb8.com
opi7.com
# Firewall: drop tcp/2332 across segments and block 107.150.106.14 (validate first).
# Example: deny tcp any any eq 2332

3 · Identify infected appliances by behavior (network-side)

# From NDR / flow data, surface devices that:
#  - resolve *.ajb8.com or talk to 107.150.106.14
#  - expose or use tcp/2332
#  - port-scan internal ranges (recon fan-out from a single source)
# Any consumer router/NAS matching -> isolate, then retire (router) or patch (QNAP).

The infected routers/NAS cannot run a Falcon sensor — remediation for the appliances is isolate → patch (QNAP) or replace (EOL routers), driven by network-side identification, while Falcon protects the managed estate.

Coverage gap (by design): AryStinger's core lives on unmanaged routers/NAS that cannot run a Falcon sensor, so the initial N-day exploitation and the on-device DNS hijack are not visible to Falcon. This pack covers the managed-estate blast radius (implant on Linux, recon, persistence port, proxy pivot, C2 sweep) and routes appliance/DNS detection to NDR, gateway DNS, and device-native checks (§7). Close the gap with passive DNS + firewall visibility on the C2 indicators and port 2332, and by retiring EOL gear.