4,000+ Routers Compromised by KadNap Malware Exploiting Vulnerabilities
## Cybersecurity: KadNap Malware Campaign Details
Cybersecurity: KadNap Malware Campaign Details
A newly identified malware campaign, known as KadNap, has compromised over 14,000 internet-exposed routers and edge devices, forming a stealth proxy botnet. The primary targets have been Asus routers.
More than 60% of the affected routers are located in the United States, with additional infections detected in Taiwan, Hong Kong, Russia, and other regions.
The campaign was initially detected when over 10,000 Asus devices were observed communicating with a suspicious set of servers in early August 2025. The infection chain begins with a shell script hosted at 212.104.141[.]140, named aic.sh, which is utilized to ensure persistence and deploy the KadNap payload.
The aic.sh script establishes an hourly cron job, retrieving a malicious shell script, renaming it to “.asusrouter,” and executing it from the /jffs/.asusrouter path. This process ensures the malware survives reboots and configuration changes.
Once persistence is established, the script downloads an ELF binary for the router, renames it to “kad,” and executes it, which is the KadNap malware. The malware is compatible with both ARM and MIPS architectures, allowing it to target a broad range of networking hardware beyond Asus models.
The campaign was initially detected when over 10,000 Asus devices were observed communicating with a suspicious set of servers in early August 2025.
KadNap daemonizes itself during initialization, redirects standard input/output to /dev/null, determines the device’s external IP address, and synchronizes time with public NTP servers. These time and uptime values are later used to construct cryptographic hashes for peer-to-peer communications.
KadNap employs a custom implementation of the Kademlia Distributed Hash Table (DHT) protocol, commonly used in technologies like BitTorrent, to obscure the true IP addresses of command-and-control (C2) servers. Infected devices use DHT lookups to discover C2 endpoints, while the traffic appears as benign peer-to-peer communication.
This methodology complicates the task of security teams in tracing and blocking KadNap’s infrastructure. The botnet leverages a fixed chokepoint structure, with all samples contacting the same two nodes before reaching the C2 servers.
KadNap bots are monetized through a residential proxy service named “Doppelganger,” a rebranding of the Faceless platform formerly supported by TheMoon malware. The service markets access to hijacked devices as highly anonymous residential proxies.
The infrastructure is segmented by device type and model, not all infected routers communicate with every C2 server, complicating attribution and linking malicious activity to specific campaigns.
Lumen has blocked traffic to and from KadNap control infrastructure on its network and is sharing indicators of compromise with the security community. Network defenders are advised to disable remote administration, apply firmware updates, and enforce strong router credentials to mitigate risks from vulnerable SOHO and IoT devices.
Based on reporting by GBHackers.