Loading story…
Researchers reported that Trojan.AndroidOS.Switcher infected Android devices and then pivoted to nearby Wi-Fi routers, brute-forcing the router web administration interface instead of directly targeting the phone owner. The malware primarily targeted TP-LINK devices and was distributed through fake Android apps, including a counterfeit Baidu client and a bogus Wi-Fi sharing application, while an associated website also functioned as command-and-control infrastructure.
After gaining router access, the malware changed DNS settings to attacker-controlled servers, enabling DNS hijacking for all devices using the compromised network. The trojan selected one of three rogue DNS servers based on the victim’s ISP, reported activation and successful compromise to its C2, and set 8.8.8.8 as a secondary resolver for resilience; exposed attacker statistics claimed 1,280 Wi-Fi networks had been infiltrated. Researchers warned that the malicious DNS settings could survive router reboots and advised users to check for rogue DNS entries and replace default router administrator credentials.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist reported on Trojan.AndroidOS.Switcher, an Android trojan that brute-forces TP-LINK router admin interfaces and changes DNS settings to attacker-controlled servers for network-wide hijacking. The report also noted exposed attacker statistics claiming 1,280 Wi-Fi networks had been successfully infiltrated.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Roaming Mantis** campaign hijacked DNS settings on compromised routers and redirected users to malicious landing pages that pushed Android malware. Victims who attempted to browse the web while connected to affected networks were instead shown fake update prompts, allowing the attackers to install malware on Android devices and potentially harvest credentials and other sensitive data. The operation stood out because it abused home and small-office networking infrastructure rather than relying solely on phishing or malicious apps. By tampering with router DNS configurations, the attackers were able to intercept traffic at the network level and selectively deliver malicious content to mobile users, expanding the reach of the campaign and demonstrating how router compromise can be used to spread malware across connected devices.
Jul 12, 2026
Infoblox researchers reported a widespread **DNS hijacking** campaign targeting **outdated consumer/home routers** across **more than three dozen countries**, where attackers compromise devices and change router-level DNS settings to silently redirect all connected users’ traffic. The manipulated DNS queries are sent to malicious resolvers hosted by **Aeza International**, a **Russian bulletproof hosting provider** that the US sanctioned in **July 2025**, allowing threat actors to control where victims are routed while keeping common destinations working to reduce suspicion. The infrastructure reportedly uses a **two-stage redirection chain**: DNS traffic is forwarded into an **HTTP-based Traffic Distribution System (TDS)** that first verifies the request originates from a compromised router and then fingerprints/filters victims before sending them onward—often into **advertising/affiliate networks** that can lead to **scams or malicious sites**. Analysts also described an evasion behavior where the rogue resolvers may only respond under specific query conditions (e.g., when **EDNS0** is disabled), complicating reproduction and detection; user-visible symptoms included selective site failures and persistent redirects that victims often misattributed to endpoints rather than the router.
Jun 29, 2026
Researchers have identified a previously undocumented botnet dubbed **AryStinger** that has compromised more than 4,000 legacy routers worldwide and repurposed them as attacker-controlled proxies for reconnaissance, tunneling, traffic interception, DNS tampering, and remote command execution. QiAnXin XLab said the campaign primarily targets outdated **RTL819X-based** devices, including **D-Link DIR-850L** and **DIR-818LW** routers, and also includes a newer Go-based variant aimed at NAS devices. Infections are concentrated in **South Korea** and **China**, with additional activity observed in **Sweden, Malaysia, and Singapore**. The malware exploits long-known flaws including `CVE-2013-3307` and `CVE-2016-5681` on older Linksys and D-Link hardware, while the NAS-focused strain has been linked to `CVE-2025-11837`. XLab reported that AryStinger communicates with command-and-control servers over HTTP/HTTPS using **Protobuf** with **XOR** encryption, establishes persistence through **Dropbear** or **gs-netcat**, and appears designed less for DDoS or cryptomining than for building covert attack infrastructure. Researchers said attribution remains unclear and urged organizations and consumers to replace end-of-life routers, update firmware, change default administrator credentials, and disable remote management.
Jul 12, 2026