Threats · 233 days ago

KadNap enlists 14,000 routers into resilient proxy botnet

Researchers found KadNap controlling ~14,000 routers to run an anonymous proxy service. Most infected devices are Asus routers in the United States. The botnet's Kademlia peer-to-peer DHT hides control nodes and resists traditional takedowns.

Timeline

• Mar 11 Reported by Ars Technica Security

Sources

1 source covering this story

• Ars Technica Security Mar 11

  14,000 routers are infected by malware that's highly resistant to takedowns

  Most of the devices are made by Asus and are located in the US.

Entities

• KadNap

Part of the PlainSec briefing for 2026-03-12

Editions

• Briefing for 2026-03-12

Related stories

• Iran-linked hackers cripple Stryker's global Microsoft environment
• Iran-aligned actors escalate cyber attacks on US, allies
• Fake developer interviews deliver backdoors, steal credentials