ASUS Routers Targeted in Expanding KadNap Botnet Operation
A sophisticated new botnet, dubbed KadNap, is exploiting vulnerabilities in ASUS routers and other networking devices, transforming them into proxies for malicious internet traffic. Since August 2025, the botnet has rapidly expanded, now encompassing approximately 14,000 compromised devices operating as a peer-to-peer network. This network leverages a customized version of the Kademlia Distributed Hash Table (DHT) protocol to connect to its command-and-control (C2) infrastructure, making it significantly more resilient to traditional disruption methods. The increasing prevalence of these botnets underscores the growing threat to home and minor business network security, and the potential for everyday devices to be weaponized in cybercrime.
The decentralized nature of KadNap’s C2 infrastructure, built upon the Kademlia DHT, presents a unique challenge to cybersecurity professionals. Unlike traditional botnets with centralized servers, KadNap distributes control information across its network of infected devices. This means that identifying and disabling the central control points becomes considerably more difficult, as each node only manages a subset of the complete data. Researchers at Black Lotus Labs, the threat research and operations arm of Lumen Technologies, have been tracking the botnet’s evolution and its impact on the digital landscape. Their analysis reveals that nearly half of the KadNap network is currently linked to C2 infrastructure specifically targeting ASUS-based routers, with the remaining portion communicating with two separate, independent control servers.
Geographically, the United States is currently the most heavily affected region, accounting for approximately 60% of all infected devices. Significant concentrations of compromised routers have also been identified in Taiwan, Hong Kong, and Russia, indicating a broad and international reach. This distribution highlights the global nature of the threat and the demand for coordinated security efforts to mitigate its impact. The botnet operators are clearly seeking to establish a widespread network of proxies to obscure their activities and facilitate malicious operations.
Source: Black Lotus Labs
How KadNap Operates: A Technical Deep Dive
The infection process begins with the download of a malicious script, named “aic.sh,” from the address 212.104.141[.]140. This script establishes persistence on the compromised device through a cron job, which executes every 55 minutes. The cron job ensures that the malware remains active even after the device is rebooted. Following successful execution of the script, an ELF binary named “kad” is installed, representing the KadNap client itself. This client is the core component responsible for establishing communication with the botnet’s C2 infrastructure and carrying out malicious activities.
Once active, the KadNap malware determines the host’s external IP address and contacts multiple Network Time Protocol (NTP) servers to obtain the current time and system uptime. This information is likely used for synchronization purposes and to ensure the malware operates correctly within the network. NTP servers are commonly used for time synchronization, but malicious actors can exploit them for other purposes, such as establishing communication channels or gathering information about compromised devices.
Source: Black Lotus Labs
A key element of KadNap’s design is its leverage of a modified Kademlia-based DHT protocol. According to Black Lotus Labs, “KadNap employs a custom version of the Kademlia Distributed Hash Table (DHT) protocol, which is used to conceal the IP address of their infrastructure within a peer-to-peer system to evade traditional network monitoring.” This implementation allows infected devices to locate and connect with C2 servers without relying on a centralized directory, making it more difficult for security researchers to identify and disrupt the botnet’s operations. The DHT protocol is designed to be resilient and decentralized, making it an attractive choice for malicious actors seeking to build robust and difficult-to-takedown networks.
However, researchers discovered a potential weakness in KadNap’s implementation of Kademlia. The malware consistently connects to two specific nodes before reaching the C2 servers, reducing the decentralization the protocol is designed to provide. This consistent connection point offers a potential avenue for identifying and disrupting the botnet’s control infrastructure. While the Kademlia protocol aims for complete decentralization, this specific implementation introduces a degree of centralization that can be exploited by defenders.
Source: Black Lotus Labs
Monetization and Links to Previous Botnets
Black Lotus Labs researchers have linked the KadNap botnet to the Doppelganger proxy service, which is believed to be a rebranding of the previously known Faceless service. Faceless was itself associated with the TheMoon malware botnet, which also targeted ASUS routers in 2024. This connection suggests a continuation of malicious activity by the same actors, adapting their tactics and infrastructure to evade detection and maintain a profitable operation.
Doppelganger operates by selling access to the infected devices as residential proxies. These proxies allow malicious actors to funnel traffic through legitimate-looking IP addresses, creating pseudonymization layers and evading blocklists. Residential proxies are particularly valuable as they are less likely to be flagged as malicious compared to traffic originating from known data center IP addresses. This makes them ideal for launching attacks such as distributed denial-of-service (DDoS) attacks, credential stuffing, and brute-force attacks.
Source: Black Lotus Labs
The use of compromised routers as proxies allows attackers to mask their true location and identity, making it more difficult to trace their activities and hold them accountable. The financial incentives driving these operations are significant, as residential proxies can command a premium price on the dark web. This creates a continuous cycle of infection and exploitation, as attackers constantly seek new ways to compromise devices and expand their proxy networks.
Lumen Technologies has taken proactive steps to disrupt the KadNap botnet, blocking all network traffic to and from the identified C2 infrastructure as of the time of this report. However, this disruption is currently limited to Lumen’s network. The company plans to release a list of indicators of compromise (IOCs) to assist other organizations in identifying and mitigating the threat on their own networks. Sharing IOCs is a crucial step in collaborative cybersecurity efforts, allowing organizations to quickly detect and respond to emerging threats.
Protecting Your Router and Network
The KadNap botnet serves as a stark reminder of the importance of securing home and small business networks. Several steps can be taken to mitigate the risk of infection. Regularly updating router firmware is paramount, as updates often include critical security patches that address known vulnerabilities. Changing the default administrator password is also essential, as default credentials are easily guessed by attackers. Enabling a firewall and using strong, unique passwords for all network devices can further enhance security. Consider enabling two-factor authentication where available for added protection.
monitoring network traffic for suspicious activity can help detect potential infections early on. Many routers offer built-in monitoring tools, or third-party security software can be used to provide more comprehensive protection. Staying informed about the latest security threats and best practices is also crucial for maintaining a secure network environment. Resources like the Cybersecurity and Infrastructure Security Agency (CISA) offer valuable guidance and alerts on emerging threats. CISA’s website provides a wealth of information on cybersecurity best practices and current threats.
The ongoing evolution of botnets like KadNap highlights the need for a multi-layered security approach. No single solution can guarantee complete protection, but by implementing a combination of preventative measures and proactive monitoring, individuals and organizations can significantly reduce their risk of becoming victims of these malicious operations. Lumen Technologies is expected to release further details regarding the KadNap botnet and its IOCs in the coming days, providing additional resources for security professionals and network administrators to combat this evolving threat.
Related reading