Loading malware…
KadNap is a Linux-based botnet malware family that primarily compromises ASUS routers and other edge networking devices, converting them into a distributed proxy network used to relay malicious traffic. Active since at least August 2025, it has been observed at scale with roughly 14,000 infected devices, with a strong concentration in the United States. The malware is associated with the Doppelganger proxy service, which has been assessed as a likely successor or rebrand of the Faceless proxy ecosystem previously linked to TheMoon-infected devices.
KadNap establishes persistence on compromised devices through a shell-script stage that schedules recurring execution and then deploys an ELF payload compiled for ARM and MIPS architectures. Once running, it suppresses visible I/O, profiles the host, obtains timing data via NTP, and joins a peer-to-peer network built on a custom implementation of the Kademlia distributed hash table protocol. This design is used to obscure command-and-control discovery by embedding infrastructure lookup within peer communications rather than relying solely on static, directly reachable controllers. KadNap also leverages BitTorrent bootstrap mechanisms during peer discovery and uses encrypted communications and peer-delivered payloads to extend functionality.
Observed follow-on payloads indicate operational hardening and controller coordination, including firewall-rule changes and retrieval of configuration data used to reach command infrastructure. Analysis has shown that KadNap’s supposedly decentralized design is imperfect: infected devices repeatedly traverse persistent intermediary nodes before reaching active controllers, suggesting attacker-maintained choke points and partial centralization. Telemetry also indicates infrastructure segmentation by device type or model.
KadNap’s primary role is to conscript compromised edge devices into a proxy botnet that supports anonymous malicious operations. Access to infected nodes has been linked to abuse patterns including traffic relaying, brute-force activity, credential-stuffing operations, targeted exploitation, and support for anonymous DDoS campaigns through the surrounding proxy ecosystem. The malware is notable for combining router-focused infection, Linux ELF payloads, persistence on embedded devices, and Kademlia-based command concealment in service of a commercialized criminal proxy operation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The file sets up a cron job to pull the malicious shell script from the server at the 55-minute mark of every hour, rename it to .asusrouter and then run it from /jffs/.asusrouter location. After the persistence was initialized, it would then pull down a malicious ELF file for the Asus routers, rename it to kad, and then execute it.
Each sample begins initialization by forking, setting STDIN, STDOUT and STDERR to /dev/null, determining the external IP address, and storing into an initialized struct.
The above function, labeled tmpSose, will check for the presence of the file /tmp/.sose and if it exists, it will read ten bytes from the file.
Next it will cycle through a list of NTP servers until it makes a connection, retrieves the current time and stores it along with the host uptime. These values are used later in the network communications to create a hash used to “phone friends” and find other peers in the network.
It will connect to the peer and receive a buffer 0x1000 bytes in size and uses a hardcoded key to decrypt it. It then SHA-1 hashes the decrypted payload and uses the hash as the key to encrypt/decrypt follow on traffic... This hash is used as the key to AES encrypt/decrypt follow on traffic.
KadNap employs a custom version of the Kademlia Distributed Hash Table (DHT) protocol, which is used to conceal the IP address of their infrastructure within a peer-to-peer system to evade traditional network monitoring. Infected devices use the DHT protocol to locate and connect with a command-and-control (C2) server.
This threat primarily targets Asus routers, conscripting them into a botnet that proxies malicious traffic... Once added to the network, bots are then marketed by a proxy service called “Doppelganger.”
This threat primarily targets Asus routers, conscripting them into a botnet that proxies malicious traffic... Once added to the network, bots are then marketed by a proxy service called “Doppelganger”.
Infected devices use the DHT protocol to locate and connect with a command-and-control (C2) server, while defenders cannot easily find and add those C2s to threat lists.
Our investigation into these C2s uncovered a malicious file which was used to download a shell script from a server at 212.104.141[.]140, in a file called aic.sh... After the persistence was initialized, it would then pull down a malicious ELF file for the Asus routers, rename it to kad, and then execute it.
An IoT botnet is a network of compromised IoT devices that attackers remotely manipulate to launch large-scale cyber attacks, typically in the form of distributed denial of service (DDoS) attacks. In October 2025, Microsoft Azure was hit with a record-breaking multi-vector, cloud DDoS attack that peaked at 15.72 Tbps and 3.64 billion packets per second.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentionné dans la liste des malwares/outils comme botnet, sans détail supplémentaire dans ce contenu.
Botnet said to primarily infect Asus routers; mentioned as a typological fit for flux-agent roles, but with no confirmed direct fast-flux linkage in the content.
A newly identified malware strain that infected edge devices, especially Asus routers, and enrolled them into the Doppelgänger proxy service to facilitate anonymous DDoS campaigns.
Proxying botnet targeting ASUS routers and other edge devices; uses a Kademlia DHT-based peer discovery/communications mechanism and C2 infrastructure to coordinate infected devices.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.