{
  "name": "KadNap Malware Turning Asus Routers Into Botnets",
  "slug": "kadnap-malware-turning-asus-routers-into-botnets",
  "description": "A sophisticated new malware called KadNap has been discovered targeting Asus routers and conscripting them into a botnet for proxying malicious traffic. The malware employs a custom version of the Kademlia Distributed Hash Table protocol to conceal its command-and-control infrastructure within a peer-to-peer system, evading traditional network monitoring. The botnet, which has grown to over 14,000 infected devices, is marketed by a proxy service called Doppelganger, tailored for criminal activity. More than 60% of KadNap's victims are based in the United States. The malware demonstrates versatility by targeting various edge networking devices and employing different C2 servers for different victim types.",
  "published": "2026-03-11T09:02:07+00:00",
  "created_at": "2026-03-11T09:02:07+00:00",
  "modified_at": "2026-03-11T09:05:55+00:00",
  "created_at_opencti": "2026-03-11T09:02:07+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-11",
    "botnet",
    "iot devices",
    "kademlia dht",
    "kadnap",
    "proxy service"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "212.104.141.140"
      },
      {
        "id": "",
        "name": "91.193.19.226"
      },
      {
        "id": "",
        "name": "79.141.161.152"
      },
      {
        "id": "",
        "name": "45.135.180.38"
      },
      {
        "id": "",
        "name": "154.7.253.12"
      },
      {
        "id": "",
        "name": "89.46.38.74"
      },
      {
        "id": "",
        "name": "45.135.180.177"
      },
      {
        "id": "",
        "name": "212.104.141.88"
      },
      {
        "id": "",
        "name": "85.158.111.100"
      },
      {
        "id": "",
        "name": "ebf9de6b67e94b2bd2b0dcda1941e04fef1a1dad830404813e468ab8744b7ed8"
      },
      {
        "id": "",
        "name": "0b3dbb951de7a216dd5032d783ba7d0a5ecda2bf872643c3a4ddd1667fb38ffe"
      }
    ],
    "malware": [
      {
        "id": "42e6c715-d5e4-4e24-b06c-5d30f56d44fb",
        "name": "TheMoon",
        "slug": "themoon"
      },
      {
        "id": "e353fa00-e807-4504-af74-63d6949f3667",
        "name": "KadNap",
        "slug": "kadnap"
      }
    ],
    "attack_patterns": [
      {
        "id": "67c697ce-a6cc-475f-9bee-e14c1bef7067",
        "name": "T1047"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "c340d47a-2ea8-41ca-9a0b-a72559b89bbf",
        "name": "T1584"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "88fa397b-4cc9-42c0-b52d-4108f9630529",
        "name": "T1095"
      },
      {
        "id": "53c193a7-f726-4bd2-ae88-4019e2604adf",
        "name": "T1046"
      },
      {
        "id": "d570881a-1f73-41ca-ad6c-fc29256c76f9",
        "name": "T1595"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "306ee8dc-1d64-4916-96be-18060d690ad7",
        "name": "T1499"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "5dee2969-7083-430e-9083-73bab54c3a18",
        "name": "T1590"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "Hong Kong"
      },
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Russian Federation"
      }
    ]
  },
  "external_refs": [
    "https://blog.lumen.com/silence-of-the-hops-the-kadnap-botnet",
    "https://otx.alienvault.com/pulse/69b13da0db907023c1bfc480"
  ]
}